civicrm: CVE-2018-1999022: CIVI-SA-2018-07: Remote code execution in QuickForm

Related Vulnerabilities: CVE-2018-1999022  

Debian Bug report logs - #904215
civicrm: CVE-2018-1999022: CIVI-SA-2018-07: Remote code execution in QuickForm

version graph

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Sat, 21 Jul 2018 19:15:02 UTC

Severity: grave

Tags: security, upstream

Found in version civicrm/4.7.30+dfsg-1

Fixed in version civicrm/5.3.1+dfsg-1

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, Dmitry Smirnov <onlyjob@debian.org>:
Bug#904215; Package src:civicrm. (Sat, 21 Jul 2018 19:15:04 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, Dmitry Smirnov <onlyjob@debian.org>. (Sat, 21 Jul 2018 19:15:05 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform
Date: Sat, 21 Jul 2018 21:11:39 +0200
Source: civicrm
Version: 4.7.30+dfsg-1
Severity: grave
Tags: security upstream
Control: fixed -1 5.3.1+dfsg-1

https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform

This is already fixed, so this bug is to track the issue in the BTS.
No CVEs seem to be assigned for the CIVI advisories.

Speaking of that, might you convince upstream to request CVE
identifiers when they plan to release a CiviCRM security advisory?

Regards,
Salvatore



Marked as fixed in versions civicrm/5.3.1+dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 21 Jul 2018 19:15:05 GMT) (full text, mbox, link).


Changed Bug title to 'civicrm: CVE-2018-1999022: CIVI-SA-2018-07: Remote code execution in QuickForm' from 'civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Tue, 24 Jul 2018 05:18:08 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 13:31:15 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.