bugGNU Health - Bugs: bug #58585, ssl-certificate for translation...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58585: ssl-certificate for translation server

Submitter:  Axel Braun <coogor>
Submitted:  Tue 16 Jun 2020 05:46:18 PM UTC
   
 
Category:  Security Severity:  4 - Important
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  meanmicio
Open/Closed:  Closed Release:  3.6.0
Module:  translate.gnusolidario.org Component:  None

Mon 22 Jun 2020 01:09:59 PM UTC, comment #1: 

About URL & SSL:
We have migrated to Weblate. More news here.
https://savannah.gnu.org/forum/forum.php?forum_id=9762

About temp dir, fixed on the latest gnuhealth-control 3.6.4
https://savannah.gnu.org/forum/forum.php?forum_id=9758

Enjoy the week!

Luis Falcon <meanmicio>
Group administrator
Tue 16 Jun 2020 05:46:18 PM UTC, original submission:  

translate.gnusolidario.org still misses a SSL certificate

1, /tmp/${lang_file} evaluates to e.g. /tmp/de.zip and is therefor predictable. On systems with fs.protected_symlinks=0 this can be used to overwrite arbitrary files
2, TRANSLATE_URL is a http URL and an active network attacker can change the content of the downloaded file
3, The first wget writes the content to the file no matter if it already exists. It also doesn't change the permissions. With that this can be used for local privilege escalation (LPE).

Axel Braun <coogor>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by meanmicio (Posted a comment)
  • -email is unavailable- added by coogor (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-06-22 meanmicio StatusNone Fixed
        Open/ClosedOpen Closed
        ReleaseNone 3.6.0

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code