10:46 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Bug ID: 1937445
Summary: CVE-2020-13959 velocity: XSS in the default error page
for VelocityView
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, akurtako(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
andjrobins(a)gmail.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
bbaranow(a)redhat.com, bibryam(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dbhole(a)redhat.com, decathorpe(a)gmail.com,
devrim(a)gunduz.org, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
ebaron(a)redhat.com,
eclipse-sig(a)lists.fedoraproject.org,
eleandro(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, fjuma(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jcoleman(a)redhat.com, jerboaa(a)gmail.com,
jjohnstn(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jperkins(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, ldimaggi(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
loleary(a)redhat.com, mat.booth(a)redhat.com,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rgrunber(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
sd-operator-metering(a)redhat.com, smaestri(a)redhat.com,
sochotni(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com, tcunning(a)redhat.com,
tflannag(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
The default error page for VelocityView in Apache Velocity Tools prior to 3.1
reflects back the vm file that was entered as part of the URL. An attacker can
set an XSS payload file as this vm file in the URL which results in this
payload being executed. XSS vulnerabilities allow attackers to execute
arbitrary JavaScript in the context of the attacked website and the attacked
user. This can be abused to steal session cookies, perform requests in the name
of the victim or for phishing attacks.
References:
https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de...
http://www.openwall.com/lists/oss-security/2021/03/10/2
--
You are receiving this mail because:
You are on the CC list for the bug.
10:47 a.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1937446, 1937447
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1937446
[Bug 1937446] CVE-2020-13959 eclipse: velocity: XSS in the default error page
for VelocityView [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1937447
[Bug 1937447] CVE-2020-13959 velocity: XSS in the default error page for
VelocityView [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
10:47 a.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
--- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> ---
Created eclipse tracking bugs for this issue:
Affects: fedora-all [bug 1937446]
Created velocity tracking bugs for this issue:
Affects: fedora-all [bug 1937447]
--
You are receiving this mail because:
You are on the CC list for the bug.
10:48 a.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1937449
--
You are receiving this mail because:
You are on the CC list for the bug.
7:37 p.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Mark Cooper <mcooper(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |velocity-tools 3.1
--- Comment #3 from Mark Cooper <mcooper(a)redhat.com> ---
Upstream fix
https://github.com/apache/velocity-tools/commit/e141828a4eb03e4b0224535ee...
(i believe)
--
You are receiving this mail because:
You are on the CC list for the bug.
11 p.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
--- Comment #4 from Mark Cooper <mcooper(a)redhat.com> ---
Both hive-container and logging-elasticsearch6-container don't have any
references to velocity-tools. I also checked the included velocity.jar and it
doesn't include the affected classes.
I think the only product here to be affected will be fuse based on our
manifests?
--
You are receiving this mail because:
You are on the CC list for the bug.
4:51 p.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
--- Comment #7 from Todd Cullum <tcullum(a)redhat.com> ---
Flaw summary:
apache-tools' VelocityView, has an error page which appears when a user
attempts to access a non-existent file on the server. It reflects the filename
of the page requested on the error page without first sanitizing the text. This
could allow a malicious actor to execute JavaScript on the page in a reflected
cross-site scripting attack. The (one liner) patch applied in
velocity-tools-view/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
uses the StringEscapeUtils.escapeHtml4() method to first sanitize the input and
prevent such an attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
4:59 p.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Todd Cullum <tcullum(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|7 |updated
--- Comment #7 has been edited ---
Flaw summary:
Apache velocity-tools' VelocityView, has an error page which appears when a
user attempts to access a non-existent file on the server. It reflects the
filename of the page requested on the error page without first sanitizing the
text. This could allow a malicious actor to execute JavaScript on the page in a
reflected cross-site scripting attack. The (one liner) patch applied in
velocity-tools-view/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
uses the StringEscapeUtils.escapeHtml4() method to first sanitize the input and
prevent such an attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
5:23 p.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
--- Comment #8 from Todd Cullum <tcullum(a)redhat.com> ---
Statement:
velocity as shipped in Red Hat Enterprise Linux 6, 7, and 8, as well as
CodeReady Studio 12, is not affected by this flaw as the affected
velocity-tools code is not present in shipped products. This includes those
shipped in javapackages-tools and pki-deps as well.
--
You are receiving this mail because:
You are on the CC list for the bug.
5:25 p.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Todd Cullum <tcullum(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|7 |updated
--- Comment #7 has been edited ---
Flaw summary:
Apache velocity-tools' VelocityView, has an error page which appears when a
user attempts to access a non-existent file on the server. It reflects the
filename of the page requested on the error page without first sanitizing the
text. This could allow a malicious actor to execute JavaScript on the page in a
reflected cross-site scripting attack. The (one liner) patch applied upstream
in
velocity-tools-view/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
uses the StringEscapeUtils.escapeHtml4() method to first sanitize the input and
prevent such an attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
7:38 a.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2021-04-13 12:38:57
--- Comment #11 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-13959
--
You are receiving this mail because:
You are on the CC list for the bug.
6:01 a.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Bug 1937445 depends on bug 1937446, which changed state.
Bug 1937446 Summary: CVE-2020-13959 eclipse: velocity: XSS in the default error page for
VelocityView [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1937446
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |NOTABUG
--
You are receiving this mail because:
You are on the CC list for the bug.
5:23 a.m.
New subject: [Bug 1937445] CVE-2020-13959 velocity: XSS in the default error page for VelocityView
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Bug 1937445 depends on bug 1937447, which changed state.
Bug 1937447 Summary: CVE-2020-13959 velocity: XSS in the default error page for
VelocityView [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1937447
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
--
You are receiving this mail because:
You are on the CC list for the bug.
1111
days inactive
1160
days old
eclipse-sig@lists.fedoraproject.org
12 comments
1 participants
participants (1)
-
bugzilla＠redhat.com