Skip to content
OpenAdvisories
Critical RHSA-2014:1194 9 CVEs

Red Hat Security Advisory: conga security and bug fix update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Rhel Cluster 5 rhel_cluster:5 conga 0:0.12.2-81.el5
Red Hat · Rhel Cluster 5 rhel_cluster:5 conga-debuginfo 0:0.12.2-81.el5
Red Hat · Rhel Cluster 5 rhel_cluster:5 luci 0:0.12.2-81.el5
Red Hat · Rhel Cluster 5 rhel_cluster:5 ricci 0:0.12.2-81.el5

Vulnerabilities 9

  • Critical 9.8
    CVE-2012-5488

    Plone Code Injection vulnerability

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

    plone PyPI
  • High 7.5
    CVE-2012-5486

    HTTP header injection in Plone and Zope2

    ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

    plone zope2 PyPI
  • High 7.5
    CVE-2012-5498

    Plone denial of service via Caching Bypass

    queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.

    plone PyPI
  • High 7.5
    CVE-2012-5499

    Plone is vulnerable to denial of service

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.

    plone PyPI
  • High 7.2
    CVE-2012-5485

    Plone Code Injection vulnerability

    registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

    plone PyPI
  • Medium 5.3
    CVE-2012-5497

    Plone User account enumeration via crafted URL

    membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.

    plone PyPI
  • Medium 5.3
    CVE-2012-5500

    Plone contains Cross-site Request Forgery

    The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

    plone PyPI
  • Unscored —
    CVE-2013-6496

    Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase,…

  • Unscored —
    CVE-2014-3521

    The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated user…

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/5.11_Technical_Notes/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=874649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=874657
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=874665
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=874681
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=878934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=878939
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=878945
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=970288
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=971541
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1065263
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1072075
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1076711
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1112813
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1194.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-5485
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5485
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5485
  • report
    https://access.redhat.com/security/cve/CVE-2012-5486
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5486
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5486
  • report
    https://access.redhat.com/security/cve/CVE-2012-5488
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5488
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5488
  • report
    https://access.redhat.com/security/cve/CVE-2012-5497
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5497
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5497
  • report
    https://access.redhat.com/security/cve/CVE-2012-5498
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5498
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5498
  • report
    https://access.redhat.com/security/cve/CVE-2012-5499
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5499
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5499
  • report
    https://access.redhat.com/security/cve/CVE-2012-5500
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5500
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5500
  • report
    https://access.redhat.com/security/cve/CVE-2013-6496
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-6496