CVE-2007-3056: websvn xss

Debian Bug report logs - #439337
CVE-2007-3056: websvn xss

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thijs Kinkhorst <thijs@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2007-3056: websvn xss

Date: Fri, 24 Aug 2007 11:40:41 +0200

[Message part 1 (text/plain, inline)]

Package: websvn
Severity: important
Tags: security

Hi,

A security issue has been reported against websvn:
Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, 
and possibly earlier, allows remote attackers to inject arbitrary web script 
or HTML via the path parameter. NOTE: the provenance of this information is 
unknown; the details are obtained solely from third party information.

It has been fixed in the new 2.0 release. This is CVE-2007-3056, please 
mention it in the changelog when uploading a fixed version.

This seems to be the fix itself:
http://websvn.tigris.org/source/browse/websvn/trunk/filedetails.php?rev=581&r1=569&r2=581

Since websvn does not have any cookie-based authentication of itself, I don't 
think this warrants updates to stable/oldstable. But still it's an important 
bug to fix.


thanks
Thijs

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 439337@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: control@bugs.debian.org

Cc: 439337@bugs.debian.org

Subject: NMU proposal

Date: Tue, 4 Sep 2007 00:08:41 +1000

[Message part 1 (text/plain, inline)]

tags 439337 patch
thanks

Hi

Attached you will find my NMU proposal for this bug.
Please give some feedback, if you agree/dissagree with that patch. Maybe you 
want to do a MU for that, which would of course be great. If you do not have 
the time for that, I would also appreciate to get your approval for the NMU.
In any case, a small feedback would be great :)
Thanks for your efforts.

Cheers
Steffen

[nmu.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 439337-close@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <white@debian.org>

To: 439337-close@bugs.debian.org

Subject: Bug#439337: fixed in websvn 1.61-22.2

Date: Tue, 04 Sep 2007 08:47:09 +0000

Source: websvn
Source-Version: 1.61-22.2

We believe that the bug you reported is fixed in the latest version of
websvn, which is due to be installed in the Debian FTP archive:

websvn_1.61-22.2.diff.gz
  to pool/main/w/websvn/websvn_1.61-22.2.diff.gz
websvn_1.61-22.2.dsc
  to pool/main/w/websvn/websvn_1.61-22.2.dsc
websvn_1.61-22.2_all.deb
  to pool/main/w/websvn/websvn_1.61-22.2_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 439337@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steffen Joeris <white@debian.org> (supplier of updated websvn package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue,  4 Sep 2007 09:42:32 +0200
Source: websvn
Binary: websvn
Architecture: source all
Version: 1.61-22.2
Distribution: unstable
Urgency: high
Maintainer: Pierre Chifflier <chifflier@cpe.fr>
Changed-By: Steffen Joeris <white@debian.org>
Description: 
 websvn     - interface for subversion repositories written in PHP
Closes: 439337
Changes: 
 websvn (1.61-22.2) unstable; urgency=high
 .
   * Non-maintainer upload by the testing-security team
   * Include CVE-2007-3056.diff to fix Cross-site scripting (XSS)
     vulnerability in filedetails.php (Closes: #439337)
     Fixes: CVE-2007-3056
Files: 
 a668cff6ad12c8654bed3620894c1b31 604 devel optional websvn_1.61-22.2.dsc
 30037ad92dcdd96d36be627b11e4d2c6 22944 devel optional websvn_1.61-22.2.diff.gz
 f19a2aba6536d23f79d7737d1fe27f97 106132 devel optional websvn_1.61-22.2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG3Q9C62zWxYk/rQcRAkmHAKCeZi5lw9cZw+GaDO+JIBLRWC3ptACeIhS4
IurmrN2S+hKrJFh4T4/jfHA=
=5/69
-----END PGP SIGNATURE-----

Message #24 received at 439337-close@bugs.debian.org (full text, mbox, reply):

From: Pierre Chifflier <pollux@debian.org>

To: 439337-close@bugs.debian.org

Subject: Bug#439337: fixed in websvn 1.61-23

Date: Mon, 24 Sep 2007 09:02:11 +0000

Source: websvn
Source-Version: 1.61-23

We believe that the bug you reported is fixed in the latest version of
websvn, which is due to be installed in the Debian FTP archive:

websvn_1.61-23.diff.gz
  to pool/main/w/websvn/websvn_1.61-23.diff.gz
websvn_1.61-23.dsc
  to pool/main/w/websvn/websvn_1.61-23.dsc
websvn_1.61-23_all.deb
  to pool/main/w/websvn/websvn_1.61-23_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 439337@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre Chifflier <pollux@debian.org> (supplier of updated websvn package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 24 Sep 2007 09:53:43 +0200
Source: websvn
Binary: websvn
Architecture: source all
Version: 1.61-23
Distribution: unstable
Urgency: low
Maintainer: Pierre Chifflier <pollux@debian.org>
Changed-By: Pierre Chifflier <pollux@debian.org>
Description: 
 websvn     - interface for subversion repositories written in PHP
Closes: 417142 439337 442137 443566
Changes: 
 websvn (1.61-23) unstable; urgency=low
 .
   * Acknowledge NMU (Closes: #442137, #439337, #417142, #443566)
   * Update my email address
Files: 
 2e61eec7b0dcbc8c8ec179d27a2a7596 601 devel optional websvn_1.61-23.dsc
 ff555e619ee8498683b8a8038cf8448b 22551 devel optional websvn_1.61-23.diff.gz
 64c4ae8aca0bd24e284a2dea3f0746e9 103844 devel optional websvn_1.61-23_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG922VtwVrWo1fQMsRAtacAKCTcVvvpJg+VkKzm3BMaV3CsyjizQCeLplK
vi8QRPaNEA5Aj4tG4yU3SQA=
=pNtQ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.