567670 - Security Advisory for Bugzilla 3.7.1, 3.6.1, 3.4.7 and 3.2.7

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

We need a sec adv for bug 309952 and bug 561797.

Comment 1

[Max Kanat-Alexander]

Attachment: v1

Comment 2

[Reed Loden [:reed]]

Comment on attachment 452954 [details]
v1

>Class:       Local Information Disclosure
>Versions:    3.5.1 to 3.6, 3.7

Missing "Fixed In".

>Description: <snip>

This sentence is way too long:
"If $use_suexec was set to "1" in the localconfig file, then the localconfig file's permissions were set as world-readable by checksetup.pl, allowing any user with local shell access to see the contents of the file, including the database password and the site_wide_secret variable used for CSRF protection."

Split it in half somehow?

>Full release downloads, patches to upgrade Bugzilla from previous
>versions, and CVS upgrade instructions are available at:

Since we're on bzr now, shouldn't this also include mention of bzr?

Comment 3

[Reed Loden [:reed]]

Also, the summary mentions 3.7.1, but the secadv doesn't... Is 3.7.1 being released? If so, it needs to be included in the "Fixed In" and the list of versions at the bottom.

Comment 4

[Max Kanat-Alexander]

Attachment: v2

All excellent points. :-)

Comment 5

[Reed Loden [:reed]]

Comment on attachment 452959 [details]
v2

>The fix for these issues are included in the 3.2.7, 3.4.7, and 3.6.1
>releases.

Missed this place for mentioning 3.7.1. Just fix it on check-in.

r=me with that.

Comment 6

[Frédéric Buclin]

Comment on attachment 452959 [details]
v2

>The Bugzilla team wish to thank the following people/organizations for
>their assistance in locating, advising us of, and assisting us to fix
>this issue:

Shouldn't timello be listed too, as he reviewed one of the sec bugs?

Comment 7

[Max Kanat-Alexander]

Oh yes, he should be! The fact that he reviewed the bug was newer than this version of the advisory. :-) I'll add him.

Comment 8

[Max Kanat-Alexander]

Attachment: v3

Here's a new version that mentions timello.

Comment 9

[Max Kanat-Alexander]

Attachment: v4

Also fix the issue reed noticed.

Comment 10

[Frédéric Buclin]

Comment on attachment 453590 [details]
v4

r=LpSolit

Comment 11

[Max Kanat-Alexander]

Security advisory sent.