Fedora has issued an advisory on March 6: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/P5C2KWZ264F2MRWTJ2AJWMBZX7MOKV4W/ Mageia 6 is also affected.
The issue is fixed upstream in 5.0.4.
Whiteboard: (none) => MGA6TOOStatus comment: (none) => Fixed upstream in 5.0.4
Assigning to the registered maintainer.
Assignee: bugsquad => shlomifCC: (none) => marja11
Update submitted to both mga7 and mga6 core/updates-testing.
Version: Cauldron => 6Whiteboard: MGA6TOO => (none)
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=9088#c14 Advisory: ======================== Updated bugzilla packages fix security vulnerability: A CSRF vulnerability in Bugzilla's report.cgi would allow a third-party site to extract confidential information from a bug the victim had access to (CVE-2018-5123). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5123 https://www.bugzilla.org/security/4.4.12/ https://www.bugzilla.org/releases/5.0.4/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/P5C2KWZ264F2MRWTJ2AJWMBZX7MOKV4W/ ======================== Updated packages in core/updates_testing: ======================== bugzilla-5.0.4-1.mga6 bugzilla-contrib-5.0.4-1.mga6 from bugzilla-5.0.4-1.mga6.src.rpm
Assignee: shlomif => qa-bugsCC: (none) => shlomifKeywords: (none) => has_procedure
Testing complete mga6 64 Used phpmyadmin to create a database user 'bugs', selected Local, and chose a stupidly complex password so it will pass the password restrictions. Ticked to create a database with the same name and clicked Go at the bottom. Installed bugzilla. # urpmi bugzilla bugzilla-contrib Ran checksetup.pl # /usr/share/bugzilla/bin/checksetup.pl Added the database info into /etc/bugzilla/localconfig # nano /etc/bugzilla/localconfig Ran checksetup.pl again # /usr/share/bugzilla/bin/checksetup.pl Entered an email and details for the admin account. Restarted httpd. # systemctl restart httpd.service Opened http://localhost/bugzilla in a browser, logged in and created a bug report. Updated bugzilla + bugzilla-contrib and created another bug. Cleaned up. Used phpmyadmin to remove the bugzilla db user and ticked to delete the database at the same time. Removed bugzilla packages.
Whiteboard: (none) => mga6-64-ok
Thanks Claire for your test, and its carefully crafted model description! Not sure of the wisdom of removing Bugzilla after all the pain to install it; it will be back! Validating on the one-is-enough basis (esp x64).
Keywords: (none) => advisory, validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0173.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED