Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 479404 (CVE-2013-4795) - <dev-python/Djblets-0.7.16: XSS (CVE-2013-4795)
Summary: <dev-python/Djblets-0.7.16: XSS (CVE-2013-4795)
Status: RESOLVED FIXED
Alias: CVE-2013-4795
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-08-01 13:59 UTC by Michael Palimaka (kensington)
Modified: 2014-10-05 18:46 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Initial Djblets-0.7.18 ebuild (Djblets-0.7.18.ebuild,1.40 KB, text/plain)
2013-09-25 15:44 UTC, Joakim Tjernlund 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Palimaka (kensington) gentoo-dev 2013-08-01 13:59:25 UTC 
* djblets.datagrid:
 * Data pulled from the database and rendered into cells are always
escaped now. Custom columns can still override this by providing
their own rendering. This led to an XSS vulnerability.
Comment 1 Joakim Tjernlund 2013-08-09 14:41:12 UTC 
something holding 0.7.16 back?
Comment 2 Michael Palimaka (kensington) gentoo-dev 2013-08-09 14:42:13 UTC 
(In reply to Joakim Tjernlund from comment #1)
> something holding 0.7.16 back?

Not as far as I know, just waiting for the maintainer to bump.
Comment 3 Ian Delaney (RETIRED) gentoo-dev 2013-08-16 04:03:36 UTC 
like I said
Comment 4 Michael Palimaka (kensington) gentoo-dev 2013-08-16 13:07:26 UTC 
(In reply to Ian Delaney from comment #3)
> like I said

?
Comment 5 Joakim Tjernlund 2013-09-15 14:05:49 UTC 
Now that django 1.4.8 and 1.5.4 are in tree, can we have Djblets 0.7.16 and
0.7.17 too?
Comment 6 Joakim Tjernlund 2013-09-25 15:44:34 UTC 
Created attachment 359434 [details]
Initial Djblets-0.7.18 ebuild

This is what I had to change from 0.7.15 to build 0.7.18:
--- Djblets-0.7.15.ebuild	2013-06-24 17:31:12.000000000 +0200
+++ Djblets-0.7.18.ebuild	2013-09-25 17:37:03.850366096 +0200
@@ -16,7 +16,7 @@
 KEYWORDS="~amd64 ~x86"
 IUSE="test"
 
-RDEPEND=">=dev-python/django-1.4.5[${PYTHON_USEDEP}]
+RDEPEND=">=dev-python/django-1.4.8[${PYTHON_USEDEP}]
 	<dev-python/django-1.5[${PYTHON_USEDEP}]
 	virtual/python-imaging[${PYTHON_USEDEP}]
 	>=dev-python/django-pipeline-1.2.24[${PYTHON_USEDEP}]
@@ -33,7 +33,6 @@
 		mkdir djblets/feedview/testdata || die
 		cp "${FILESDIR}"/sample.rss djblets/feedview/testdata || die
 	fi
-	epatch "${FILESDIR}"/exclude-tests.patch
 	distutils-r1_python_prepare_all
 }
Comment 7 Joakim Tjernlund 2013-09-30 08:58:44 UTC 
Seems like this package has been left behind. Could some other gentoo dev bump this package?
Comment 8 Michael Palimaka (kensington) gentoo-dev 2014-04-19 18:17:05 UTC 
Vulnerable versions are no longer in the tree.