Your message dated Mon, 08 Oct 2018 08:45:39 +0000
with message-id <e1g9raz-000epg...@fasolo.debian.org>
and subject line Bug#909738: fixed in php-horde-kronolith 4.2.24-1
has caused the Debian Bug report #909738,
regarding php-horde-kronolith: CVE-2017-16908 XSS via Name field
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
909738: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909738
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: php-horde-kronolith
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerability was published for php-horde-kronolith.
CVE-2017-16908[0]:
| In Horde Groupware 5.2.19, there is XSS via the Name field during
| creation of a new Resource. This can be leveraged for remote code
| execution after compromising an administrator account, because the
| CVE-2015-7984 CSRF protection mechanism can then be bypassed.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-16908
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16908
Please adjust the affected versions in the BTS as needed.
Regards,
Markus
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: php-horde-kronolith
Source-Version: 4.2.24-1
We believe that the bug you reported is fixed in the latest version of
php-horde-kronolith, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 909...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mathieu Parent <sath...@debian.org> (supplier of updated php-horde-kronolith
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 08 Oct 2018 09:51:44 +0200
Source: php-horde-kronolith
Binary: php-horde-kronolith
Architecture: source all
Version: 4.2.24-1
Distribution: unstable
Urgency: medium
Maintainer: Horde Maintainers <team+debian-horde-t...@tracker.debian.org>
Changed-By: Mathieu Parent <sath...@debian.org>
Description:
php-horde-kronolith -
Closes: 909737 909738
Changes:
php-horde-kronolith (4.2.24-1) unstable; urgency=medium
.
* New upstream version 4.2.24
* CVE-2017-16906 XSS via URL field (Closes: #909737)
* CVE-2017-16908 XSS via Name field (Closes: #909738)
Checksums-Sha1:
851c7b44f005ecf4907273b5a5faa8be63cddf74 2175 php-horde-kronolith_4.2.24-1.dsc
0ff53e58c4b9b519dcf672a6c2b0226712245d6f 2644494
php-horde-kronolith_4.2.24.orig.tar.gz
eaf94c632dc1679f18a11dab3696cc947364aab4 4800
php-horde-kronolith_4.2.24-1.debian.tar.xz
e4a3d4cd98323e4c46e2a2b93ae8cfe451fbdf9f 1394764
php-horde-kronolith_4.2.24-1_all.deb
a5827569a9aacb4a562fa6b561700bb3c99d4c57 6234
php-horde-kronolith_4.2.24-1_amd64.buildinfo
Checksums-Sha256:
275680fe9461c4d5a77475b3646c5c77e9e2d69169d552242df8b91e5f1954d5 2175
php-horde-kronolith_4.2.24-1.dsc
adde767c5fa90a5cb3848188681dae11f64d7fc51a5698742942dbf699ed2507 2644494
php-horde-kronolith_4.2.24.orig.tar.gz
17ae36bc6af4459ab554d640b9b2ba1169fc767c01b5d1fa29fa12b6e91dbf87 4800
php-horde-kronolith_4.2.24-1.debian.tar.xz
5526c1f6003703267677aa71db08389a289f24b864fa05007662afde700925ad 1394764
php-horde-kronolith_4.2.24-1_all.deb
5595d01d71658e0af648d4a79d311319d381f0bf7a7e8d6d42db24e895ebaa3a 6234
php-horde-kronolith_4.2.24-1_amd64.buildinfo
Files:
9ecf98b7a507645bf584ad4687675f81 2175 php optional
php-horde-kronolith_4.2.24-1.dsc
816c12223eaf6618fff3534a59a9eace 2644494 php optional
php-horde-kronolith_4.2.24.orig.tar.gz
07ce38e710395764d75d3892472beadd 4800 php optional
php-horde-kronolith_4.2.24-1.debian.tar.xz
ada6de7001de666ebec9174531314eb6 1394764 php optional
php-horde-kronolith_4.2.24-1_all.deb
6148ade3dd6bb6ce86f64fb8cffc04a3 6234 php optional
php-horde-kronolith_4.2.24-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCAAxFiEEqIGbPTP9weQZ135HrgOYBGZoH6UFAlu7DtoTHHNhdGhpZXVA
ZGViaWFuLm9yZwAKCRCuA5gEZmgfpUZQEACQ8aO6OMAdqC4QP5TfRdQuA0DYHAGX
RR+V24ciYlFl3WAHRthqdU55rbRb1UXDukOi8d+SqckGNcnh15oslUbML4kA+FvV
QfsNKc8RsyFkr/+OoimcYo4ZMP+brnv70lbODbxvIKaJyUOM0LmkpAGp/NeRHuNO
wxPCYWkS4swjHJ2lZZ/3Xm0+t6t+0As4KV5dNyXlfkdh/qZS5kzGIGzyJXsuYwwn
j/hAMlfFIKh5kzRFFVGnwCgK8sOF2AJJHzQCRZXRqFApsysSxdy3G/vm3kMiw2hL
YP6KmxUL/j9Eb9sBsVtsQUg4HTEoJeb4VhfRM7UUBNeSe3TE4xq3JJrfjNdIllIC
5AkQ6+ds2wXg1FtYdvWgOxax6VS0nUP0DkoLobTpCEVcmBnugmpKqPMr0x1T84fh
kEVX2OsKQTeNBe5LqZkY0xXdtSUH48InaZwGUnVhs57h44VFjsG6ls2VS+BPxzWf
0UlHxJHfV215P409qVFWerxaWeJo5a8PbhBuKvZhu5IDQB3YxvcoO/z8MXZYFTYb
bNI/5WXKFN7ASLHmDSrk17WGAZeCucuVbdrHjnWy73ZQ+xj4xZGLLEgg+GcHinOc
O3CFEd2mb391IwvneOlmDg12VsRf70KtG7M+qwgxwArdzE4k5cW1b+n12dcIWp4v
nOEZTFYN+3baaA==
=ZoJ4
-----END PGP SIGNATURE-----
--- End Message ---
