777398 - (CVE-2012-1968) [SECURITY] HTML bugmail exposes information about restricted bugs

Status: RESOLVED FIXED

(Bugzilla :: Email Notifications, defect)

Description

[:glob ✱]

html bugmail uses the bug_link filter to linkify 'bug NNN' text, both within comments, and when other bugs are referenced (eg blockers, dependencies).

the bug_link code always tests if the current user has access to the bug it's marking up, and if not, it sets the title to just the bug's status.

however when constructing bugmail, the current user is the user which made the change -- we need to test if to_user has access to the bug.

Comment 1

[Frédéric Buclin]

Affects Bugzilla 4.1.1 and newer. We will need a 4.2.2 and a 4.3.2 release asap.

As you can mention private attachments in comments too, both Bugzilla::Template::get_bug_link() and Bugzilla::Template::get_attachment_link() must be fixed. We should pass a new optional argument to the bug_link() and quoteURLs() filters which, if present, override the user object when validating permissions.

Comment 2

[Frédéric Buclin]

I know that Denis is going to upgrade Eclipse Bugzilla to 4.2.1 on Friday, so CC'ing him so that he knows what the problem is with HTML bugmails. The point is: either wait for Bugzilla 4.2.2, or disable HTML bugmails once the upgrade is done from

  Administration > Default Preferences > Preferred email format > Text Only + Enabled off

"Enable off" will prevent users from selecting HTML bugmails. They will be forced to get plain text emails only (as in Bugzilla 4.0 and older).

Comment 3

[Daniel Veditz [:dveditz]]

use CVE-2012-1968 for this bug.

Comment 4

[Frédéric Buclin]

Taking! I'm on it.

Comment 5

[Frédéric Buclin]

Attachment: patch, v1

This patch applies to both trunk and 4.2.1. It also fixes bug 777586 as both bugs are closely related.

Comment 6

[:glob ✱]

Comment on attachment 645982 [details] [diff] [review]
patch, v1

r=glob on the condition that bug_list_link is fixed on commit

the bug_list_link filter must also accept an options parameter and pass it to get_bug_link.  while it isn't used in bugzilla's default bugmail template, it's possible for extensions or custom bugmail templates to use this filter.

Comment 7

[Frédéric Buclin]

Attachment: patch, v2

Also fixing bug_list_link(). Carrying forward glob's r+.

Comment 8

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified Bugzilla/Hook.pm
modified Bugzilla/Template.pm
modified template/en/default/email/bugmail.html.tmpl
Committed revision 8306.


Committing to: bzr+ssh://[e-mail]/bugzilla/4.2/
modified Bugzilla/Hook.pm
modified Bugzilla/Template.pm
modified template/en/default/email/bugmail.html.tmpl
Committed revision 8108.

Comment 9

[Frédéric Buclin]

Security advisory sent.