OpenPKG Security Advisory
OpenPKG-SA-2004.056
Publisher Name: OpenPKG GmbH Publisher Home: http://openpkg.com/ Advisory Id (public): OpenPKG-SA-2004.056 Advisory Type: OpenPKG Security Advisory (SA) Advisory Directory: http://openpkg.com/go/OpenPKG-SA Advisory Document: http://openpkg.com/go/OpenPKG-SA-2004.056 Advisory Published: 2010-09-03 23:32 UTC Issue Id (internal): OpenPKG-SI-20041217.02 Issue First Created: 2004-12-17 Issue Last Modified: 2006-11-28 Issue Revision: 05
Subject Name: CVSTrac Subject Summary: Bug Tracking System for CVS Subject Home: http://www.cvstrac.org/ Subject Versions: * <= 1.1.4 Vulnerability Id: CVE-2004-1146 Vulnerability Scope: global (not OpenPKG specific) Attack Feasibility: run-time Attack Vector: remote network Attack Impact: identity fraud Description: Michael Krax discovered a Cross-Site Scripting (XSS) vulnerability in the CVS repository web frontend CVSTrac [1]. All versions below CVSTrac 1.1.5 are affected. References: [1] http://www.cvstrac.org/ [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1146 [3] http://www.openpkg.org/tutorial.html#regular-source [4] http://www.openpkg.org/tutorial.html#regular-binary [5] ftp://ftp.openpkg.org/release/2.2/UPD/cvstrac-1.1.4-2.2.1.src.rpm [6] ftp://ftp.openpkg.org/release/2.1/UPD/cvstrac-1.1.3-2.1.3.src.rpm [7] ftp://ftp.openpkg.org/release/2.2/UPD/ [8] ftp://ftp.openpkg.org/release/2.1/UPD/ [9] http://www.openpkg.org/security.html#signature
Primary Package Name: cvstrac Primary Package Home: http://openpkg.org/go/package/cvstrac Affected Distribution: Affected Branch: Affected Package: OpenPKG Community 2.1-SOLID cvstrac-1.1.3-2.1.2 OpenPKG Community 2.2-SOLID cvstrac-1.1.4-2.2.0 OpenPKG Community CURRENT cvstrac-1.1.4-20041109 Corrected Distribution: Corrected Branch: Corrected Package: OpenPKG Community 2.1-SOLID cvstrac-1.1.3-2.1.3 OpenPKG Community 2.2-SOLID cvstrac-1.1.4-2.2.1 OpenPKG Community CURRENT cvstrac-1.1.5-20041217
