Lucene search

DebianDEBIAN:DLA-1905-1:0200A

HistoryAug 31, 2019 - 2:32 p.m.

[SECURITY] [DLA 1905-1] gosa security update

2019-08-3114:32:38

lists.debian.org

263

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

Package : gosa
Version : 2.7.4+reloaded2-1+deb8u5
CVE ID : CVE-2019-14466

GOsa² used unserialize to restore filter settings from a cookie. Since
this cookie was supplied by the client, authenticated users could have
passed arbitrary content to unserialized, which opened GOsa² up to a
potential PHP object injection.

For Debian 8 "Jessie", this problem has been fixed in version
2.7.4+reloaded2-1+deb8u5.

We recommend that you upgrade your gosa packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

–

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: [email protected], http://sunweavers.net

Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian10allgosa-plugin-rolemanagement< 2.7.4+reloaded3-8+deb10u2gosa-plugin-rolemanagement_2.7.4+reloaded3-8+deb10u2_all.deb
Debian10allgosa-plugin-mail< 2.7.4+reloaded3-8+deb10u2gosa-plugin-mail_2.7.4+reloaded3-8+deb10u2_all.deb
Debian9allgosa-plugin-openxchange< 2.7.4+reloaded2-13+deb9u3gosa-plugin-openxchange_2.7.4+reloaded2-13+deb9u3_all.deb
Debian9allgosa-schema< 2.7.4+reloaded2-13+deb9u3gosa-schema_2.7.4+reloaded2-13+deb9u3_all.deb
Debian8allgosa-help-fr< 2.7.4+reloaded2-1+deb8u5gosa-help-fr_2.7.4+reloaded2-1+deb8u5_all.deb
Debian10allgosa-plugin-dns-schema< 2.7.4+reloaded3-8+deb10u2gosa-plugin-dns-schema_2.7.4+reloaded3-8+deb10u2_all.deb
Debian8allgosa-plugin-pptp-schema< 2.7.4+reloaded2-1+deb8u5gosa-plugin-pptp-schema_2.7.4+reloaded2-1+deb8u5_all.deb
Debian8allgosa-plugin-sudo-schema< 2.7.4+reloaded2-1+deb8u5gosa-plugin-sudo-schema_2.7.4+reloaded2-1+deb8u5_all.deb
Debian8allgosa-plugin-fai-schema< 2.7.4+reloaded2-1+deb8u5gosa-plugin-fai-schema_2.7.4+reloaded2-1+deb8u5_all.deb
Debian8allgosa-help-en< 2.7.4+reloaded2-1+deb8u5gosa-help-en_2.7.4+reloaded2-1+deb8u5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	gosa-plugin-rolemanagement	< 2.7.4+reloaded3-8+deb10u2	gosa-plugin-rolemanagement_2.7.4+reloaded3-8+deb10u2_all.deb
Debian	10	all	gosa-plugin-mail	< 2.7.4+reloaded3-8+deb10u2	gosa-plugin-mail_2.7.4+reloaded3-8+deb10u2_all.deb
Debian	9	all	gosa-plugin-openxchange	< 2.7.4+reloaded2-13+deb9u3	gosa-plugin-openxchange_2.7.4+reloaded2-13+deb9u3_all.deb
Debian	9	all	gosa-schema	< 2.7.4+reloaded2-13+deb9u3	gosa-schema_2.7.4+reloaded2-13+deb9u3_all.deb
Debian	8	all	gosa-help-fr	< 2.7.4+reloaded2-1+deb8u5	gosa-help-fr_2.7.4+reloaded2-1+deb8u5_all.deb
Debian	10	all	gosa-plugin-dns-schema	< 2.7.4+reloaded3-8+deb10u2	gosa-plugin-dns-schema_2.7.4+reloaded3-8+deb10u2_all.deb
Debian	8	all	gosa-plugin-pptp-schema	< 2.7.4+reloaded2-1+deb8u5	gosa-plugin-pptp-schema_2.7.4+reloaded2-1+deb8u5_all.deb
Debian	8	all	gosa-plugin-sudo-schema	< 2.7.4+reloaded2-1+deb8u5	gosa-plugin-sudo-schema_2.7.4+reloaded2-1+deb8u5_all.deb
Debian	8	all	gosa-plugin-fai-schema	< 2.7.4+reloaded2-1+deb8u5	gosa-plugin-fai-schema_2.7.4+reloaded2-1+deb8u5_all.deb
Debian	8	all	gosa-help-en	< 2.7.4+reloaded2-1+deb8u5	gosa-help-en_2.7.4+reloaded2-1+deb8u5_all.deb