Description
The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | bugzilla | 2.14.2-0woody4 | DSA-230 |
Advisories 1
- DSA-230 bugzilla - insecure permissions, spurious backup files Debian Security (DSA / DLA) · Mar 9, 2026
References
- 6351 vdb-entry
- 6501 vdb-entry
- bugzilla-htaccess-database-password(10970) vdb-entry
- 20030102 [BUGZILLA] Security Advisory - remote database password disclosure mailing-list
- DSA-230 vendor-advisory