Katello Multiple XSS Vulnerability Fix (CVE-2013-2101)

Critical Vulnerability Information Bug ID: Bug 963568 (CVE-2013-2101) CVE Number: CVE-2013-2101 Product: Katello Component: Multiple XSS in various entities Priority: Medium Severity: Medium Status: CLOSED ERRATA Vulnerability Description Reporter Eric Helms discovered multiple Cross-Site Scripting (XSS) vulnerabilities in Katello. Reproduction Steps 1. Log in 2. Navigate to Changeset/Repository/System/Distributor/Filter 3. Create an entity and name it 4. Submit Actual Results The success message is displayed as a clickable link in notifications. Users can navigate to the "Notifications" page and see the clickable link displayed after the entity is successfully created. If a Changeset is created, the Changeset name appears on the right side of the Changeset management page. Expected Results The name should be fully escaped in every location where it is used. Issue Analysis 1. Some entities are unaffected because backend model validation prevents the use of HTML , , characters. 2. User input is not escaped when output, leading to XSS vulnerabilities. Fix Details Most entities including , , , , , , and have been fixed. Fix commits include: - - User notification messages should escape HTML characters - - Ensure ORG names containing HTML characters are escaped - Default text content function and quick replace for displaying characters in notifications using - Override the text area function to prevent escaping of text containing ,

Goal Reached Thanks to every supporter — we hit 100%!

Katello Multiple XSS Vulnerability Fix (CVE-2013-2101)