From mkanat at bugzilla.org Sat Oct 1 02:20:25 2005 From: mkanat at bugzilla.org (Max Kanat-Alexander) Date: Fri, 30 Sep 2005 19:20:25 -0700 Subject: Security Advisory for Bugzilla 2.18.3, 2.20rc2, and 2.21 Message-ID: <1128133225.9078.7.camel@localhost.localdomain> Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers two security bugs that have recently been discovered and fixed in the Bugzilla code: + config.cgi exposes information to users who aren't logged in, even when "requirelogin" is turned on in Bugzilla. + It is possible to bypass the "user visibility groups" restrictions if user-matching is turned on in "substring" mode. All Bugzilla installations are advised to upgrade to the latest stable version of Bugzilla, 2.20. Development snapshots of 2.21 before 2.21.1 are also vulnerable. If you are using a development snapshot, you should upgrade to 2.21.1, use CVS to update, or apply the patches from the specific bugs listed below. None of these vulnerabilities affect the old Bugzilla 2.16 branch. Vulnerability Details ===================== Issue 1 ------- Class: Information Leak Versions: 2.18rc1 - 2.18.3, 2.19 - 2.20rc2, 2.21 Description: config.cgi gives JavaScript and RDF information about Bugzilla to third-party clients, including a list of products in the Bugzilla installation. The "requirelogin" parameter requires that all people be logged into Bugzilla before seeing any data, as a security measure. In affected versions, config.cgi is always accessible, and always contains information to non-logged-in users, even when "requirelogin" is turned on, possibly exposing product names that administrators expected to be confidential. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=308256 Issue 2 ------- Class: Information Leak Versions: 2.19.1 - 2.20rc2, 2.21 Description: Bugzilla contains features to prevent users from "seeing" other users, enabled by the "usevisibilitygroups" parameter. Bugzilla also contains a feature called "user matching," which enables users to type in part of a username and get back a list of possible matches. If user matching is turned on and is in "substring" mode, all matching users will be returned to a query, regardless of the visibility groups settings, exposing users who should be invisible. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=308662 Vulnerability Solutions ======================= The fixes for all of the security bugs mentioned in this advisory are included in the 2.18.4, 2.20, and 2.21.1 releases. Upgrading to these releases will protect installations from possible exploits of these issues. Full release downloads, patches to upgrade Bugzilla from previous versions, and CVS upgrade instructions are available at: http://www.bugzilla.org/download/ Specific patches for each of the individual issues can be found on the corresponding bug reports for each issue, at the URL given in the reference for that issue in the list above. Credits ======= The Bugzilla team wish to thank the following people for their assistance in locating, advising us of, and assisting us to fix these situations: Fr?d?ric Buclin Joel Peshkin Myk Melez Max Kanat-Alexander General information about the Bugzilla bug-tracking system can be found at http://www.bugzilla.org/ Comments and follow-ups can be directed to the netscape.public.mozilla.webtools newsgroup or the mozilla-webtools mailing list; http://www.bugzilla.org/support/ has directions for accessing these forums. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part URL: From mkanat at bugzilla.org Sat Oct 1 02:28:14 2005 From: mkanat at bugzilla.org (Max Kanat-Alexander) Date: Fri, 30 Sep 2005 19:28:14 -0700 Subject: Bugzilla 2.20 Released (and 2.18.4, 2.21.1) Message-ID: <1128133694.9078.12.camel@localhost.localdomain> The Bugzilla Project is proud to announce the release of Bugzilla 2.20, a major new feature release for Bugzilla. Bugzilla 2.20 includes support for PostgreSQL, a new "Large Attachment" storage mechanism, a new level of bug classification, user-defined periodic reminders by email, and many other major new features. It includes hundreds of bug fixes and enhancements over Bugzilla 2.18. You can see a description of all the new features in Bugzilla 2.20 at: http://www.bugzilla.org/releases/2.20/new-features.html We are also releasing a security fix for the 2.18 series, 2.18.4. In addition, we are releasing our first development snapshot of the 2.21 series, 2.21.1. Use it at your own risk -- it has received very little testing at this point! Both 2.20 and 2.21.1 also include security fixes, and we encourage all users of 2.19, 2.20rc1, 2.20rc2, and 2.21 to upgrade to these latest versions. There is no release on the Bugzilla 2.16 branch, because it was not affected by any of the security issues. Download -------- Bugzilla is available at: http://www.bugzilla.org/download/ Release Notes & Changes ----------------------- Before installing, it is VERY IMPORTANT to read the Release Notes: http://www.bugzilla.org/releases/2.20/release-notes.html To see a list of all changes between your version of Bugzilla and the current version of Bugzilla, you can use the chart at: http://www.bugzilla.org/status/changes.html Status Update ------------- We have a *very* extensive Status Update this time for you! Read all about our new releases and all the activity of the Bugzilla Project: http://www.bugzilla.org/status/2005-09-30.html Try Out Bugzilla ---------------- If you'd like to test-drive Bugzilla, you can use the demo installations of Bugzilla at: http://landfill.bugzilla.org/ Security Advisory ----------------- You can see the details of the security issues fixed in these releases, here: http://www.bugzilla.org/security/2.18.4/ Support ------- You can ask questions for free on the mailing lists (or in IRC) about Bugzilla, or you can hire a paid consultant to help you out: Free Support: http://www.bugzilla.org/support/ Paid Support: http://www.bugzilla.org/support/consulting.html About Bugzilla -------------- Bugzilla is a "Defect Tracking System" or "Bug-Tracking System." Defect Tracking Systems allow individual or groups of developers to keep track of outstanding bugs in their product effectively. Most commercial defect-tracking software vendors charge enormous licensing fees. Despite being "free", Bugzilla has many features its expensive counterparts lack. Consequently, Bugzilla has quickly become a favorite of hundreds of organizations across the globe, and is widely regarded as one of the top defect-tracking systems available. See http://www.bugzilla.org/about/ for more details. -Max Kanat-Alexander Release Manager, Bugzilla Project