rt4: vulnerable to a cross-site scripting (XSS) attack via the user and group rights management pages and the cryptography interface (CVE-2015-5475)
We have discovered security vulnerabilities which affect both RT 4.0.x and RT 4.2.x. We are releasing RT versions 4.0.24 and 4.2.12 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 4.0 and 4.2.
The vulnerabilities addressed by 4.0.24, 4.2.12, and the below patches include the following:
RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack via the user and group rights management pages. This vulnerability is assigned CVE-2015-5475. It was discovered and reported by Marcin Kopeć at Data Reliance Shared Service Center.
RT 4.2.0 and above are vulnerable to a cross-site scripting (XSS) attack via the cryptography interface. This vulnerability could allow an attacker with a carefully-crafted key to inject JavaScript into RT’s user interface. Installations which use neither GnuPG nor S/MIME are unaffected.
Patches for all releases of 4.0.x and 4.2.x are available (signature). Versions of RT older than 4.0.0 are unsupported and do not receive security patches; please contact sales@bestpractical.com if you need assistance with an older RT version.
Reference:
>
http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html
(from redmine: issue id 4522, created on 2015-08-14, closed on 2016-06-24)
- Relations:
- child #4523 (closed)
- child #4524 (closed)
- child #4525 (closed)
- child #4526 (closed)
- Changesets:
- Revision 065902c0 by Natanael Copa on 2015-08-14T06:56:53Z:
main/rt4: security upgrade to 4.2.12 (CVE-2015-5475)
ref #4522