USN-4609-1: GOsa vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4609-1
October 28, 2020
gosa vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in gosa.
Software Description:
- gosa: Web Based LDAP Administration Program
Details:
Fabian Henneke discovered that GOsa incorrectly handled client cookies. An
authenticated user could exploit this with a crafted cookie to perform
file deletions in the context of the user account that runs the web
server. (CVE-2019-14466)
It was discovered that GOsa incorrectly handled user access control. A
remote attacker could use this issue to log into any account with a
username containing the word "success". (CVE-2019-11187)
Fabian Henneke discovered that GOsa was vulnerable to cross-site scripting
attacks via the change password form. A remote attacker could use this
flaw to run arbitrary web scripts. (CVE-2018-1000528)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
gosa 2.7.4+reloaded2-9ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4609-1
CVE-2018-1000528, CVE-2019-11187, CVE-2019-14466
Package Information:
https://launchpad.net/ubuntu/+source/gosa/2.7.4+reloaded2-9ubuntu1.1
A GOsa security update has been released for Ubuntu Linux 16.04 LTS.
