FEDORA-2015-bee38cd15f

security update in Fedora 21 for monitorix

Status: obsolete

This is a maintenance release that mainly fixes a Document Object Model (DOM)-based cross-site scripting (XSS) vulnerability in the monitorix.cgi file. Such vulnerability is by injection a JS code in the when parameter of the URL shown after generating the graphs. Additionally, a potential denial of service (DoS) issue was discovered in the same when parameter of the URL which could lead in the creation of an enormous amount of .png files in the imgs directory of the server.

Comments 7

This update has been submitted for testing by mikaku.

This update has been pushed to testing.

This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes

This update has been submitted for stable by mikaku.

Taskotron: upgradepath test FAILED on noarch. Result log: https://taskotron.fedoraproject.org/resultsdb/results/4997037 (results are informative only)

This update has been submitted for stable by bodhi.

Add Comment & Feedback

Please login to add feedback.

Content Type
RPM
Status
obsolete
Test Gating
Request
stable
Submitted by
Update Type
security
Update Severity
medium
Karma
+1
stable threshold: 1
unstable threshold: -1
Autopush (karma)
Enabled
Autopush (time)
Disabled
Dates
submitted 3 years ago
in testing 3 years ago

Related Bugs 1

00 #1281979 monitorix-3.8.1 is available

Automated Test Results