CVE-2019-7313

NameCVE-2019-7313
Descriptionwww/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs921271

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
buildbot (PTS)buster2.0.1-2fixed
bullseye2.10.1-1fixed
bookworm3.7.0-2fixed
sid, trixie3.10.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
buildbotsourcejessie(not affected)
buildbotsourcestretch(not affected)
buildbotsource(unstable)2.0.0-1921271

Notes

[stretch] - buildbot <not-affected> (Vulnerable code introduced in 0.9.0)
[jessie] - buildbot <not-affected> (Vulnerable code introduced in 0.9.0)
https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code
https://github.com/buildbot/buildbot/pull/4584/files#diff-a2e7e3ee5f6a1d3cd9c6abf0328c21e0

Search for package or bug name: Reporting problems