Description
Multiple cross-site scripting (XSS) vulnerabilities in Buildbot 0.7.6 through 0.7.11p2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, different vulnerabilities than CVE-2009-2959.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | buildbot | 0.7.11p3-1 | — |
| Debian 13 | buildbot | 0.7.11p3-1 | — |
| Debian 12 | buildbot | 0.7.11p3-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | buildbot | >= 0.7.6, < 0.7.11p3 | 0.7.11p3 | GHSA-mj3x-wprp-mvj9 |
| PyPI | buildbot | >= 0.7.6, < 0.7.12 | 0.7.12 | PYSEC-2009-2 |
References
- FEDORA-2009-8577 vendor-advisory
- FEDORA-2009-8516 vendor-advisory
- ADV-2009-2352 vdb-entry
- [Buildbot-devel] 20090813 Re: Cross-site scripting vulnerability mailing-list
- http://buildbot.net/trac#SecurityAlert
- 36352 third-party-advisory
- buildbot-unspecified-xss(52896) vdb-entry
- 36418 third-party-advisory
- 36100 vdb-entry