CVE-2019-13122

MITTEL 6.1CVE-2019-13122 · Published 10/07/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-13122 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in patchwork (ozlabs).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.3%, höher als bei 71.4% aller Schwachstellen.
Abhilfe: auf 2.0.4, 2.1.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
patchwork ozlabs	`= 2.1.0≥ 1.1, < 2.0.4≥ 2.1.0, < 2.1.4`	`2.0.42.1.4`

Description

A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.

References

jk.ozlabs.org/projects/patchwork · Vendor Advisory
openwall.com/lists/oss-security/2019/07/05/1 · Mailing List
getpatchwork/patchwork · Third Party Advisory
getpatchwork/patchwork release · Release Notes
lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html · Mailing List
lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html · Mailing List
lists.ozlabs.org/pipermail/patchwork/2019-July/date.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free