| Summary: | bugzilla new security issue CVE-2018-5123 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | marja11, shlomif, sysadmin-bugs |
| Version: | 6 | Keywords: | advisory, has_procedure, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | mga6-64-ok | ||
| Source RPM: | bugzilla-5.0.3-2.mga7.src.rpm | CVE: | |
| Status comment: | Fixed upstream in 5.0.4 | ||
|
Description
David Walser
2018-03-11 14:31:33 CET
The issue is fixed upstream in 5.0.4. Whiteboard:
(none) =>
MGA6TOO Assigning to the registered maintainer. Assignee:
bugsquad =>
shlomif Update submitted to both mga7 and mga6 core/updates-testing. Version:
Cauldron =>
6 Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=9088#c14 Advisory: ======================== Updated bugzilla packages fix security vulnerability: A CSRF vulnerability in Bugzilla's report.cgi would allow a third-party site to extract confidential information from a bug the victim had access to (CVE-2018-5123). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5123 https://www.bugzilla.org/security/4.4.12/ https://www.bugzilla.org/releases/5.0.4/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/P5C2KWZ264F2MRWTJ2AJWMBZX7MOKV4W/ ======================== Updated packages in core/updates_testing: ======================== bugzilla-5.0.4-1.mga6 bugzilla-contrib-5.0.4-1.mga6 from bugzilla-5.0.4-1.mga6.src.rpm Assignee:
shlomif =>
qa-bugs Testing complete mga6 64 Used phpmyadmin to create a database user 'bugs', selected Local, and chose a stupidly complex password so it will pass the password restrictions. Ticked to create a database with the same name and clicked Go at the bottom. Installed bugzilla. # urpmi bugzilla bugzilla-contrib Ran checksetup.pl # /usr/share/bugzilla/bin/checksetup.pl Added the database info into /etc/bugzilla/localconfig # nano /etc/bugzilla/localconfig Ran checksetup.pl again # /usr/share/bugzilla/bin/checksetup.pl Entered an email and details for the admin account. Restarted httpd. # systemctl restart httpd.service Opened http://localhost/bugzilla in a browser, logged in and created a bug report. Updated bugzilla + bugzilla-contrib and created another bug. Cleaned up. Used phpmyadmin to remove the bugzilla db user and ticked to delete the database at the same time. Removed bugzilla packages. Whiteboard:
(none) =>
mga6-64-ok Thanks Claire for your test, and its carefully crafted model description! Not sure of the wisdom of removing Bugzilla after all the pain to install it; it will be back! Validating on the one-is-enough basis (esp x64). Keywords:
(none) =>
advisory, validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0173.html Resolution:
(none) =>
FIXED |