[Bug 1185514] New: RabbitMQ: /api/... XSS vulnerability
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1185514
Bug ID: 1185514
Summary: RabbitMQ: /api/... XSS vulnerability
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: kseifried(a)redhat.com
CC: abaron(a)redhat.com, aortega(a)redhat.com,
apevec(a)redhat.com, ayoung(a)redhat.com,
chrisw(a)redhat.com, dallan(a)redhat.com,
erlang(a)lists.fedoraproject.org, gkotton(a)redhat.com,
hubert.plociniczak(a)gmail.com, jeckersb(a)redhat.com,
josh(a)fornwall.com, lemenkov(a)gmail.com, lhh(a)redhat.com,
lpeer(a)redhat.com, markmc(a)redhat.com,
pmyers(a)redhat.com, rbryant(a)redhat.com,
rjones(a)redhat.com, s(a)shk.io, sclewis(a)redhat.com,
yeylon(a)redhat.com
26437 prevent /api/* from returning text/html error messages which could act as
an XSS vector (since 2.1.0)
Bug 26437 allowed an attacker to create a URL to "/api/..." which would
provoke an internal server error, resulting in the server returning an
html page with text from the URL embedded and not escaped. This was
fixed by ensuring all URLs below /api/ only ever return responses with a
content type of application/json, even in the case of an internal server
error.
Upstream patches:
http://hg.rabbitmq.com/rabbitmq-web-dispatch/rev/caf3d0a80cf3
References:
https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1152267] New: Support multiple instances of couchdb
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1152267
Bug ID: 1152267
Summary: Support multiple instances of couchdb
Product: Fedora
Version: rawhide
Component: couchdb
Assignee: lemenkov(a)gmail.com
Reporter: thomas(a)apestaart.org
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org, lemenkov(a)gmail.com,
wtogami(a)gmail.com
Created attachment 946532
--> https://bugzilla.redhat.com/attachment.cgi?id=946532&action=edit
older style init file
Description of problem:
couchdb is often used as a supporting database for different software which
recommends using a different separate instance for various reasons. Examples I
know of are:
- hood.ie which uses different parameters for the config of couchdb
- feat, a clustering agent which uses python view servers which need to be
custom-configured
- desktopcouch, which uses per-user couch instances
- puppet can use it as an ENC
I'm adding an init file (for older Fedora and pre-7 RHEL), and a systemd
multiple instances file.
In my puppet modules for couchdb, I also add some selinux rules for these
differently named instances, which potentially might make sense to just put in
selinux-policy-targeted instead.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month