Bug 456268 – <dev-ruby/rdoc-3.12.1: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template (CVE-2013-0256)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-02-09 09:30:00 UTC]

From $URL :

Jan Lieskovsky 2013-02-05 05:56:14 EST
A cross-site scripting (XSS) flaw was found in the way Darkfish Rdoc HTML generator / template of 
RDoc, HTML and command-line documentation producing tool for Ruby, performed sanitization of 
certain values when creating Rdoc documentation. When Ruby on Rails application exposed its 
documentation via network, a remote attacker could provide a specially-crafted URL that, when 
opened would lead to arbitrary web script or HTML code execution in the context of (particular Ruby 
on Rails application) user's session.

This issue affects RDoc versions 2.3.0 to 3.12.

[Comment 1 Hans de Graaff 2013-02-10 07:38:58 UTC]

=dev-ruby/rdoc-3.12.1 is in the tree with fixes for this. Note that we remove the bundled versions of rdoc in dev-lang/ruby* and only use this gem.

[Comment 2 Sean Amoss (RETIRED) 2013-02-25 22:22:55 UTC]

(In reply to comment #1)
> =dev-ruby/rdoc-3.12.1 is in the tree with fixes for this. Note that we
> remove the bundled versions of rdoc in dev-lang/ruby* and only use this gem.

Thanks, Hans.

Arches, please test and mark stable.

[Comment 3 Agostino Sarubbo 2013-02-26 10:56:11 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2013-02-26 11:00:20 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2013-02-26 11:41:13 UTC]

ia64 stable

[Comment 6 Agostino Sarubbo 2013-02-26 11:52:42 UTC]

hppa stable

[Comment 7 Agostino Sarubbo 2013-02-26 11:57:53 UTC]

arm stable

[Comment 8 Agostino Sarubbo 2013-02-26 12:05:57 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2013-02-26 12:07:31 UTC]

ppc64 stable

[Comment 10 Agostino Sarubbo 2013-02-26 13:10:14 UTC]

sparc stable

[Comment 11 Agostino Sarubbo 2013-02-26 14:45:05 UTC]

s390 stable

[Comment 12 Agostino Sarubbo 2013-03-01 11:17:25 UTC]

alpha stable

[Comment 13 Agostino Sarubbo 2013-03-01 12:42:22 UTC]

sh stable

[Comment 14 GLSAMaker/CVETool Bot 2013-03-04 23:20:09 UTC]

CVE-2013-0256 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0256):
  darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as
  used in Ruby, does not properly generate documents, which allows remote
  attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

[Comment 15 Tobias Heinlein (RETIRED) 2013-03-24 19:46:11 UTC]

Ready for vote, I vote NO.

[Comment 16 Sean Amoss (RETIRED) 2013-04-09 23:04:28 UTC]

GLSA vote: no, XSS.

Closing noglsa.