Lucene search

DebianDEBIAN:DLA-1436-1:481DD

HistoryJul 20, 2018 - 10:07 p.m.

[SECURITY] [DLA 1436-1] gosa security update

2018-07-2022:07:02

lists.debian.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.023 Low

EPSS

Percentile

89.7%

JSON

Package : gosa
Version : 2.7.4+reloaded2-1+deb8u3
CVE ID : CVE-2018-1000528
Debian Bug : 902723

Fabian Henneke discovered a cross-site scripting vulnerability in the
password change form of GOsa, a web-based LDAP administration program.

For Debian 8 "Jessie", this problem has been fixed in version
2.7.4+reloaded2-1+deb8u3.

We recommend that you upgrade your gosa packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

–

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: [email protected], http://sunweavers.net

Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian9allgosa-plugin-uw-imap< 2.7.4+reloaded2-13+deb9u1gosa-plugin-uw-imap_2.7.4+reloaded2-13+deb9u1_all.deb
Debian9allgosa-plugin-webdav< 2.7.4+reloaded2-13+deb9u1gosa-plugin-webdav_2.7.4+reloaded2-13+deb9u1_all.deb
Debian8allgosa-plugin-pureftpd< 2.7.4+reloaded2-1+deb8u3gosa-plugin-pureftpd_2.7.4+reloaded2-1+deb8u3_all.deb
Debian8allgosa-plugin-nagios< 2.7.4+reloaded2-1+deb8u3gosa-plugin-nagios_2.7.4+reloaded2-1+deb8u3_all.deb
Debian8allgosa-plugin-dns< 2.7.4+reloaded2-1+deb8u3gosa-plugin-dns_2.7.4+reloaded2-1+deb8u3_all.deb
Debian9allgosa-plugin-rsyslog< 2.7.4+reloaded2-13+deb9u1gosa-plugin-rsyslog_2.7.4+reloaded2-13+deb9u1_all.deb
Debian8allgosa-dev< 2.7.4+reloaded2-1+deb8u3gosa-dev_2.7.4+reloaded2-1+deb8u3_all.deb
Debian8allgosa-plugin-dns-schema< 2.7.4+reloaded2-1+deb8u3gosa-plugin-dns-schema_2.7.4+reloaded2-1+deb8u3_all.deb
Debian9allgosa-plugin-systems< 2.7.4+reloaded2-13+deb9u1gosa-plugin-systems_2.7.4+reloaded2-13+deb9u1_all.deb
Debian8allgosa-plugin-nagios-schema< 2.7.4+reloaded2-1+deb8u3gosa-plugin-nagios-schema_2.7.4+reloaded2-1+deb8u3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	gosa-plugin-uw-imap	< 2.7.4+reloaded2-13+deb9u1	gosa-plugin-uw-imap_2.7.4+reloaded2-13+deb9u1_all.deb
Debian	9	all	gosa-plugin-webdav	< 2.7.4+reloaded2-13+deb9u1	gosa-plugin-webdav_2.7.4+reloaded2-13+deb9u1_all.deb
Debian	8	all	gosa-plugin-pureftpd	< 2.7.4+reloaded2-1+deb8u3	gosa-plugin-pureftpd_2.7.4+reloaded2-1+deb8u3_all.deb
Debian	8	all	gosa-plugin-nagios	< 2.7.4+reloaded2-1+deb8u3	gosa-plugin-nagios_2.7.4+reloaded2-1+deb8u3_all.deb
Debian	8	all	gosa-plugin-dns	< 2.7.4+reloaded2-1+deb8u3	gosa-plugin-dns_2.7.4+reloaded2-1+deb8u3_all.deb
Debian	9	all	gosa-plugin-rsyslog	< 2.7.4+reloaded2-13+deb9u1	gosa-plugin-rsyslog_2.7.4+reloaded2-13+deb9u1_all.deb
Debian	8	all	gosa-dev	< 2.7.4+reloaded2-1+deb8u3	gosa-dev_2.7.4+reloaded2-1+deb8u3_all.deb
Debian	8	all	gosa-plugin-dns-schema	< 2.7.4+reloaded2-1+deb8u3	gosa-plugin-dns-schema_2.7.4+reloaded2-1+deb8u3_all.deb
Debian	9	all	gosa-plugin-systems	< 2.7.4+reloaded2-13+deb9u1	gosa-plugin-systems_2.7.4+reloaded2-13+deb9u1_all.deb
Debian	8	all	gosa-plugin-nagios-schema	< 2.7.4+reloaded2-1+deb8u3	gosa-plugin-nagios-schema_2.7.4+reloaded2-1+deb8u3_all.deb