Am 07.05.2016 um 22:38 schrieb Simon McVittie: > On Sat, 07 May 2016 at 20:52:16 +0200, Markus Koschany wrote: >> the Debian LTS team would like to fix the security issues which are >> currently open in the Wheezy version of ikiwiki: >> https://security-tracker.debian.org/tracker/CVE-2016-4561 > > I'm well aware of that vulnerability, having discovered it myself. > > I'm currently waiting for feedback from the security team on how they > want me to deal with the security-related 3.20160506 changes in jessie. > I found CVE-2016-4561 accidentally while mitigating the recent ImageMagick > flaws, which I consider to be much more important - CVE-2016-4561 is > only cross-site scripting (I don't actually know of a specific exploit, > although it can probably be exploited somehow) whereas the ImageMagick > flaws are remote arbitrary code execution in some wiki configurations.
You are probably referring to CVE-2016-3714. I'm not sure but wouldn't a
fix for ImageMagick also resolve this for ikiwiki? Or is this another
CVE-worthy issue in ikiwiki?
>> Would you like to take care of this yourself?
>
> That would probably be best if we're doing the ImageMagick mitigation;
> I had to backport a lot of fixes to the img plugin to get that to
> apply to jessie. It might make most sense to just drop in the entire
> img plugin from jessie, or for that matter a backport of all of
> ikiwiki from jessie.
>
> I'm not sure how much sense it makes to maintain webapps in LTS by
> backporting individual changes, to be honest.
CVE-2016-4561 would be rather easy to fix in Wheezy but if you think the
ImageMagick mitigation is even more important, it is certainly possible
to fix that too. We usually prefer the same minimal changes as for all
security fixes but depending on the package / webapp in question it does
make sense to consider a backport. Since you are most certainly the one
who knows ikiwiki best, we would leave it to you to make that
assessment. Feel free to send in the debdiff for review or just follow
our procedure that we have outlined at
https://wiki.debian.org/LTS/Development
Thanks for your help
Markus
signature.asc
Description: OpenPGP digital signature
