443044 - Security Advisory for Bugzilla 3.2 RC1, 3.0.5, 2.22.5

Status: RESOLVED FIXED

(Bugzilla :: bugzilla.org, defect)

Description

[Frédéric Buclin]

Bug 437169 has been fixed in 2.22.5 and newer. We need a security advisory for it. No other security bug on the road.

Comment 1

[Frédéric Buclin]

Attachment: security advisory, v1

I don't know the real name of the reporter. I just sent him an email to get it. I will update the sec adv if he replies on time.

Comment 2

[Frédéric Buclin]

Attachment: security advisory, v1.1

The real name of the reporter is Ilja van Sprundel.

Comment 3

[Max Kanat-Alexander]

Comment on attachment 332385 [details]
security advisory, v1.1

>Class:       Exposure system information

  I'm not certain that's the right class...

>             The security fix makes sure the relative path is always
>             ignored.

  Add an additional paragraph:

  Most Bugzilla installations will not be vulnerable, as they don't use importxml.pl.


  Our security advisories get reprinted everywhere, and sometimes people write about them, and it's nice to explicitly point out that it's not that bad of a vulnerability because very few installations will be affected.

Comment 4

[Frédéric Buclin]

Attachment: security advisory, v2

Changed class to Directory Traversal, and added the paragraph about the issue not affecting most installations.

Comment 5

[Max Kanat-Alexander]

Comment on attachment 332425 [details]
security advisory, v2

>             Most Bugzilla installations will not be vulnerable, as
>             they do not use --attach_path with importxml.pl.

  Most installations don't even use importxml.

  But this all looks fine.

Comment 6

[Max Kanat-Alexander]

Security advisory sent.