MGASA-2023-0019

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2023-0019.html
Import Source
https://advisories.mageia.org/MGASA-2023-0019.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2023-0019
Related
Published
2023-01-24T07:58:25Z
Modified
2023-01-24T06:35:07Z
Summary
Updated viewvc packages fix security vulnerability
Details

ViewVC is vulnerable to cross-site scripting. The impact of these vulnerabilities is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. (CVE-2023-22456, CVE-2023-22464)

References
Credits

Affected packages

Mageia:8 / viewvc

Package

Name
viewvc
Purl
pkg:rpm/mageia/viewvc?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.0-0.dev20200516.1.1.mga8

Ecosystem specific 

{
    "section": "core"
}