moin: CVE-2016-7148: XSS in AttachFile view (multifile related)

Debian Bug report logs - #844341
moin: CVE-2016-7148: XSS in AttachFile view (multifile related)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: moin: CVE-2016-7148: XSS in AttachFile view (multifile related)

Date: Mon, 14 Nov 2016 16:47:37 +0100

Source: moin
Version: 1.9.8-1
Severity: important
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for moin.

CVE-2016-7148[0]:
XSS in AttachFile view (multifile related)

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-7148
[1] http://hg.moinmo.in/moin/1.9/rev/eceb70c41ecc

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 844341@bugs.debian.org (full text, mbox, reply):

From: Paul Wise <pabs@debian.org>

To: 844341@bugs.debian.org, wiki <wiki@debian.org>, Debian Security <security@debian.org>

Subject: Re: moin: CVE-2016-7148: XSS in AttachFile view (multifile related)

Date: Tue, 15 Nov 2016 12:49:02 +0800

[Message part 1 (text/plain, inline)]

On Mon, 14 Nov 2016 16:47:37 +0100 Salvatore Bonaccorso wrote:

> [1] http://hg.moinmo.in/moin/1.9/rev/eceb70c41ecc

I've tested this patch on the Debian wiki and it definitely fixes it.

If your wiki admins are active it is pretty unlikely to be able to get
past their review of RecentChanges though.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 844341@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 844340@bugs.debian.org, 844341@bugs.debian.org, 844338@bugs.debian.org

Subject: CVE-2016-7146, CVE-2016-7148, CVE-2016-9119

Date: Tue, 15 Nov 2016 21:02:10 +0100

severity 844340 serious
severity 844341 serious
severity 844338 serious
thanks

Hi

1.9.8-1+deb8u1 released via DSA-3715-1 after it got testing exposed on
wiki.d.o.

Although the issues are not necessarly "RC", I increased now the
severity to serious, reason behind that is that stretch should get the
fixes as well. I assume it will work if it is proped up from jessie to
stretch on the next point release as well, but it's probably better to
have a proper upload.

Regards,
Salvatore

Message #22 received at 844341-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 844341-close@bugs.debian.org

Subject: Bug#844341: fixed in moin 1.9.8-1+deb8u1

Date: Fri, 18 Nov 2016 15:02:32 +0000

Source: moin
Source-Version: 1.9.8-1+deb8u1

We believe that the bug you reported is fixed in the latest version of
moin, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 844341@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated moin package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 14 Nov 2016 21:24:29 +0100
Source: moin
Binary: python-moinmoin
Architecture: all source
Version: 1.9.8-1+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Steve McIntyre <93sam@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 844338 844340 844341
Description: 
 python-moinmoin - Python clone of WikiWiki - library
Changes:
 moin (1.9.8-1+deb8u1) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2016-7146: XSS in GUI editor's attachment dialogue (Closes: #844340)
   * CVE-2016-7148: XSS in AttachFile view (multifile related)
     (Closes: #844341)
   * CVE-2016-9119: XSS in GUI editor's link dialogue (Closes: #844338)
Checksums-Sha1: 
 8b54874b6d2c9d24236c8b96e21d3bfc3eaf5dbf 2048 moin_1.9.8-1+deb8u1.dsc
 bead31f53152395aa93c31dc3e0a8a417be39ccd 37140821 moin_1.9.8.orig.tar.gz
 22808c5fe0b5a02b47cb203dfaf8fcfb1bc2c74e 148948 moin_1.9.8-1+deb8u1.debian.tar.xz
 a0ab3dbd5ea449a3b680fffd343fe03a814685b0 7182696 python-moinmoin_1.9.8-1+deb8u1_all.deb
Checksums-Sha256: 
 34ca9384c2e9471a3dfdde52b84b44674613f5a40330eb565508f64b9e871dbe 2048 moin_1.9.8-1+deb8u1.dsc
 a74ba7fd8cf09b9e8415a4c45d7389ea910c09932da50359ea9796e3a30911a6 37140821 moin_1.9.8.orig.tar.gz
 9824100234f561827e87ae91b0983cf41a4b19779f617d9f40deae9a09376f13 148948 moin_1.9.8-1+deb8u1.debian.tar.xz
 8f00de48e0c72c4e1a85051d6fd465e57763abeb3a7d97b4969b381d64e27b2d 7182696 python-moinmoin_1.9.8-1+deb8u1_all.deb
Files: 
 c6bc5ae411d04e45288adbb810eff950 2048 net optional moin_1.9.8-1+deb8u1.dsc
 375a57b62565c789488c4d5b759c182c 37140821 net optional moin_1.9.8.orig.tar.gz
 c0ff895702b75e64ada69028a716ab61 148948 net optional moin_1.9.8-1+deb8u1.debian.tar.xz
 09532d81e3be7d08f25961df09b9d04b 7182696 python optional python-moinmoin_1.9.8-1+deb8u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlgqHl1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ESS4QAIEmI+pBrMvnCY9e6McFDw6T2rmCZjb2
kpUQ79zEQam0aEiaoGK7lXL3IDem+gFtkg6+arSOSIaFzko4b8YAtvRlHxaLEwAv
2JueFNjxcF3qd69oTnXaZVKbs8YiZDCMCPU2ZV8JzkIvjfqqZPuBOS/d6zdSdMxG
qThCNBrLTDt3PrdtDgm9ePAE2IL7QjdYadcwzZCSeLpG2hrfYf5tA6YWdFoLhMVd
gRTAVHZFyGgJXbuus1YTJJboTFHv30gzjevqYF0jJI8IZeMBAr7rUBi2/rz1f/g6
7MGWLEqjkYvsdYKLvgoxKW0BPV9Jbu8XmGNn7GPnFSDHcv9iWqunkbykCc4qcXa8
J7Wo9NWjF9eJyAlG1kXkpkJAirFRaQUS1JRul8cnZ0cBtwA70twUlcg7ut0DmLNt
F3RhRrQr/e8VrYKrfq1aOCyVmdDfdmM9rp4nWV5R5K6RDfz0zc4QtZv8h8mGJMZd
5AznSBNaKoZYNFRrxntezUgbcBAqey9lpVhlLFMGUkuFfkn7gub8iw6f1tknbqPa
P3F/FhH+MTmRslIjepp9+Rxw8yFYNxKuNY7TNR26/uU6poA/py93A8EsESG8807Z
/yKXu4yVB/FvpBkh+uVPZGkW2Sqa+ts7IMNPuB2xPV7hTZTeFyctJXAklZSISIji
aDHAg1ufBBaY
=yEGg
-----END PGP SIGNATURE-----

Message #27 received at 844341-close@bugs.debian.org (full text, mbox, reply):

From: Steve McIntyre <93sam@debian.org>

To: 844341-close@bugs.debian.org

Subject: Bug#844341: fixed in moin 1.9.9-1

Date: Fri, 09 Dec 2016 01:33:37 +0000

Source: moin
Source-Version: 1.9.9-1

We believe that the bug you reported is fixed in the latest version of
moin, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 844341@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steve McIntyre <93sam@debian.org> (supplier of updated moin package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu,  8 Dec 2016 22:13:08 +0000
Source: moin
Binary: python-moinmoin
Architecture: source all
Version: 1.9.9-1
Distribution: unstable
Urgency: medium
Maintainer: Steve McIntyre <93sam@debian.org>
Changed-By: Steve McIntyre <93sam@debian.org>
Description:
 python-moinmoin - Python clone of WikiWiki - library
Closes: 794014 844338 844340 844341
Changes:
 moin (1.9.9-1) unstable; urgency=medium
 .
   * New upstream release, lots of bug fixes
   * Includes a few security updates:
     + CVE-2016-9119: XSS in GUI editor's link dialogue
       (Closes: #844338)
     + CVE-2016-7146: XSS in GUI editor's attachment dialogue
       (Closes:#844340)
     + CVE-2016-7148: XSS in AttachFile view (multifile related)
       (Closes: #844341)
   * Apply recommended patch from upstream: fix wrong digestmod of hmac.new
     calls
   * Update patches to fit upstream changes:
     + use_systemwide_libs.patch
     + mail-verification.patch
   * Add patch from Paul Wise to implement an incremental dump process in
     moin dump
   * Fix timestamps to make package build reproducibly. Thanks to Eduard
     Sanou for the patch. Closes: #794014
Checksums-Sha1:
 c5b52bbc46da4d278b4e992505ea00dac944c8d3 1851 moin_1.9.9-1.dsc
 d582126c443939cb09e650eeddd677ed7e8c3f99 37206341 moin_1.9.9.orig.tar.gz
 fe32d0193d51e5a7d46a10a7fc2dc6960162cdd0 151888 moin_1.9.9-1.debian.tar.xz
 36f5edd96dc9973173c31a4cf1b9be163891f6bf 5334 moin_1.9.9-1_amd64.buildinfo
 aa34148e565c69e16d8e3445c996a7741316bd57 7982778 python-moinmoin_1.9.9-1_all.deb
Checksums-Sha256:
 c7da8347baee23ffec9b0a8fa94705aa4d0cfabf5bd9b06d53e07dff77ac938f 1851 moin_1.9.9-1.dsc
 4397d7760b7ae324d7914ffeb1a9eeb15e09933b61468072acd3c3870351efa4 37206341 moin_1.9.9.orig.tar.gz
 36ffe07570ace5c281d62e9d507265344a28159bf05e1c800261d9ad450cd76a 151888 moin_1.9.9-1.debian.tar.xz
 3389ae6d68002699dbd00df498002d1d8e054fc9d2b55b1027547094c9a4cc2c 5334 moin_1.9.9-1_amd64.buildinfo
 a94b14db49c274684ef4775edff82c2e4658e7946ee251565ae98c8eb1d6ded0 7982778 python-moinmoin_1.9.9-1_all.deb
Files:
 dc3ec3f28992c14532b7f54c04af21df 1851 net optional moin_1.9.9-1.dsc
 32f02a5d0df06b80d889ca6cdc51593e 37206341 net optional moin_1.9.9.orig.tar.gz
 62a970dbcd97797d8a2320144b74f930 151888 net optional moin_1.9.9-1.debian.tar.xz
 10676e0532049269ef40da0a36369cf4 5334 net optional moin_1.9.9-1_amd64.buildinfo
 a747ee0d9e279a5e35e6f21557c23933 7982778 python optional python-moinmoin_1.9.9-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJYSgRXAAoJEFh5eVc0QmhOCigP/1OCin2RmTpWLW/+exrnVruC
Xpu+X3RLxSl9b0qaRJRj992rwUWkS21tEMuLaxmaLcuUbOecC0nJljiVJ1ZpKykt
kLyNmiYT/n+D4UywFhoc19CFPTF3scF0WKpvGVnSqw29GEQYK7xbi6WXyKKtgMUm
sgdEAO5trAGMdcqMIpUs6FNDNkBJo3nNW+mj4opDxBHuDG5/4XirZEYUvKlHrnAF
G6dwheEjlUMYfgMBbMN81fcR313JXEKM2hGwtR/MPf4XlpNmijOBNgNYYcaVn6Yu
9RXO3BhjR9mPy1OBkzrkTlOMtL9H4OSe/oYGM9jZA6y7jLO7u0zPG7aW2JL0LU8L
ZozzxPwB1T80I07Nrb0Jd/Yo5EsCwnLwDOX3diOrl+6q7PIgA78qE4+eGmQI3Y5Q
tu0s+t2Fg9FhaiK5rehb/KYuoQi1Meeomrw04vILYf8vfK4TD681XzxcsYuTxSg7
2Fff9BrMojZlpuyOpSrj4PovDTG7wO2TmigrloToLylO31IAR2GHntTGgY1iJ9RF
HniQGQOGOayxD7FvEoRh6SfMdCaD+sVyT0bdbR7L1OGyRYQtLYHygNfie3onIWxF
salZP+fZWh76mKj4x+bFyJRWIO9US4V+WPF7e9SXVcW8MpN4I5COVKweNqwAvXQv
fUYeXGKd9Uggx8aaxz9i
=85fC
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.