Bug 941396 – VUL-0: CVE-2015-5179: FreeIPA: non-printable characters aren't checked in every case of user data

Bug 941396 - (CVE-2015-5179) VUL-0: CVE-2015-5179: FreeIPA: non-printable characters aren't checked in every case of user data

(CVE-2015-5179)
Summary:	VUL-0: CVE-2015-5179: FreeIPA: non-printable characters aren't checked in eve...

Status:	RESOLVED FIXED

Classification:	openSUSE
Product:	openSUSE Distribution
Classification:	openSUSE
Component:	Security
Version:	13.2
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal (vote)
Target Milestone:	---
Assigned To:	Howard Guo
QA Contact:	E-mail List

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2015-08-12 09:06 UTC by Alexander Bergmann
Modified:	2016-07-15 07:55 UTC (History)
CC List:	0 users

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2015-08-12 09:06:35 UTC

https://fedorahosted.org/freeipa/ticket/5153

Reported by: 	alich

We might need more string checks for non-printable characters (same issue with \177 - DEL). VERSION: 4.2.90.201507201402GIT37b1af9, API_VERSION: 2.146

Affected:
openSUSE:Factory/freeipa available on Tumbleweed:


No OBS bugowner found. Assign to last committer Howard Guo.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1252567
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5179
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5179

Comment 1 Swamp Workflow Management 2015-08-12 22:00:16 UTC

bugbot adjusting priority

Comment 2 Howard Guo 2015-09-14 08:14:27 UTC

Redhat seems to have planned to address the issue in a future release of FreeIPA. I will keep track of their progress and upgrade the package as soon as a fix is available.

Comment 3 Howard Guo 2016-07-15 07:55:06 UTC

freeipa has been removed from tw.

Comment 4 Howard Guo 2016-07-15 07:55:59 UTC

sorry, didn't get a chance to resolve the issue before running out of time on a freeipa upgrade.