Debian Bug report logs - #558376
Invalid or Forged http://l.d.o/foo/recent url disclose server environement

Package: lists.debian.org; Maintainer for lists.debian.org is Debian Listmaster Team <listmaster@lists.debian.org>;

Reported by: Frank Lin PIAT <fpiat@klabs.be>

Date: Sat, 28 Nov 2009 12:36:01 UTC

Severity: minor

Merged with 582885

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Listmaster Team <listmaster@lists.debian.org>:
Bug#558376; Package lists.debian.org. (Sat, 28 Nov 2009 12:36:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Frank Lin PIAT <fpiat@klabs.be>:
New Bug report received and forwarded. Copy sent to Debian Listmaster Team <listmaster@lists.debian.org>. (Sat, 28 Nov 2009 12:36:04 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Frank Lin PIAT <fpiat@klabs.be>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Invalid or Forged http://l.d.o/foo/recent url disclose server environement
Date: Sat, 28 Nov 2009 13:31:09 +0100
Package: lists.debian.org
Severity: wishlist

Hello,

An invalid link to list's  "recent" page, like:
  http://lists.debian.org/debian-foobar/recent
discloses the environment variable of the server.

I doesn't seems to be a problem at this time (except maybe on some
stupid web browsers which ignores the page mime-type=text/plain... in
which case it could be used for script/css injection)

Franklin





Severity set to 'minor' from 'wishlist' Request was from Cord Beermann <cord@debian.org> to control@bugs.debian.org. (Fri, 11 Jun 2010 21:09:09 GMT) Full text and rfc822 format available.

Merged 558376 582885. Request was from Cord Beermann <cord@debian.org> to control@bugs.debian.org. (Fri, 11 Jun 2010 21:24:16 GMT) Full text and rfc822 format available.

Merged 558376 582885. Request was from Cord Beermann <cord@debian.org> to control@bugs.debian.org. (Sat, 12 Jun 2010 09:39:03 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 19:51:07 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.