Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 520420 (CVE-2014-3594) - <www-apps/horizon-2014.1.2: Persistent XSS in Horizon Host Aggregates interface (CVE-2014-3594) (OSSA 2014-027)
Summary: <www-apps/horizon-2014.1.2: Persistent XSS in Horizon Host Aggregates interfa...
Alias: CVE-2014-3594
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~4 [noglsa]
Depends on:
Reported: 2014-08-21 14:48 UTC by Agostino Sarubbo
Modified: 2014-08-21 21:09 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-08-21 14:48:22 UTC
From ${URL} :

OpenStack Security Advisory: 2014-027
CVE: CVE-2014-3594
Date: August 19, 2014
Title: Persistent XSS in Horizon Host Aggregates interface
Reporters: Dennis Felsch and Mario Heiderich (Ruhr-University Bochum)
Products: Horizon
Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.2

Dennis Felsch and Mario Heiderich from the Horst Görtz Institute for
IT-Security, Ruhr-University Bochum reported a persistent XSS in
Horizon. A malicious administrator may conduct a persistent XSS attack
by registering a malicious host aggregate in Horizon Host Aggregate
interface. Once executed in a legitimate context this attack may reveal
another admin token, potentially resulting in a lateral privilege
escalation. All Horizon setups are affected.

Juno (development branch) fix:

Icehouse fix:

Havana fix:

This fix will be included in the Juno-3 development milestone and in
future 2013.2.4 and 2014.1.3 releases.


@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2014-08-21 20:59:55 UTC
fixed in =www-apps/horizon-2014.1.2

badness removed
Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-08-21 21:09:32 UTC
Thanks for the ebuild and cleanup. 

No stable versions, closing noglsa.