FS#43841 - [mantisbt] CVE-2014-8986

Attached to Project: Community Packages
Opened by Paul (grangeway) - Monday, 16 February 2015, 10:48 GMT
Last edited by Maxime Gauduin (Alucryd) - Friday, 10 April 2015, 07:11 GMT
Task Type Bug Report
Category Upstream Bugs
Status Closed
Assigned To Maxime Gauduin (Alucryd)
Architecture All
Severity Critical
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Hello,

ArchLinux reports that CVE-2014-8986 is fixed in their distribution of Mantis.

This is not the case as the vulnerable code is still included.

Please see http://issue-track.org/security/CVE-2014-8986.html for original patch for this issue and status.

Thanks
This task depends upon

Closed by  Maxime Gauduin (Alucryd)
Friday, 10 April 2015, 07:11 GMT
Reason for closing:  Fixed
Additional comments about closing:  1.2.19-2
Comment by Maxime Gauduin (Alucryd) - Tuesday, 17 February 2015, 10:46 GMT
Just pushed 1.2.19-2 in [testing], can you please confirm the security breach is indeed fixed?
Comment by Levente Polyak (anthraxx) - Wednesday, 18 February 2015, 11:11 GMT
@alucryd:
A confirmation from someone running this would be nice, however the initial finder confirms that the patch you applied mitigates the issue [0].
I just wanted to say that IMHO i do not think this is a 'critical' issue (highest possible severity) as its XSS and also requires administrator privileges to perform, but never-mind its still a bad issue :)

[0] http://www.openwall.com/lists/oss-security/2015/02/16/2

Loading...