roundup: CVE-2019-10904

Debian Bug report logs - #926587
roundup: CVE-2019-10904

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: submit@bugs.debian.org

Subject: roundup: CVE-2019-10904

Date: Sun, 07 Apr 2019 07:58:19 -0400

Package: roundup
Version: 1.4.20-1.1+deb8u1
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for roundup.

CVE-2019-10904[0]:
| Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and
| roundup/cgi/wsgi_handler.py mishandle 404 errors.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-10904
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10904


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #10 received at 926587-done@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: 926587-done@bugs.debian.org

Subject: Re: Bug#926587: Acknowledgement (roundup: CVE-2019-10904)

Date: Sun, 07 Apr 2019 08:04:14 -0400

The Debian Bug Tracking System wrote:

> Thank you for filing a new Bug report with Debian.

… aaaand I've just noticed that src:roundup was removed since jessie, so
closing this bug.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

Message #15 received at 926587-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 926587-submitter@bugs.debian.org

Subject: closing 926587

Date: Sun, 07 Apr 2019 15:27:39 +0200

close 926587 1.4.20-1.1+deb8u2
thanks

Send a report that this bug log contains spam.