Lucene search

Gentoo FoundationMGASA-2014-0462

HistoryNov 21, 2014 - 3:44 p.m.

Updated python-djblets packages fix security vulnerabilities

2014-11-2115:44:16

Gentoo Foundation

advisories.mageia.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

65.8%

JSON

Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name (CVE-2014-3994). Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 Django allows remote attackers to inject arbitrary web script or HTML via a user display name (CVE-2014-3995).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchpython-djblets< 0.7.30-1.1python-djblets-0.7.30-1.1.mga4

OS	Version	Architecture	Package	Version	Filename
Mageia	4	noarch	python-djblets	< 0.7.30-1.1	python-djblets-0.7.30-1.1.mga4

References

bugs.mageia.org/show_bug.cgi?id=13504

lists.fedoraproject.org/pipermail/package-announce/2014-June/134416.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

65.8%

JSON

Related for MGASA-2014-0462