mahara-packaging team mailing list archive

[Jamie Strandboge <jamie@xxxxxxxxxx>]

Marking Invalid for Lucid. See bug #556407 instead (sync request).

** Also affects: mahara (Ubuntu Jaunty)
   Importance: Undecided
       Status: New

** Also affects: mahara (Ubuntu Karmic)
   Importance: Undecided
       Status: New

** Also affects: mahara (Ubuntu Lucid)
   Importance: Undecided
       Status: New

** Changed in: mahara (Ubuntu Lucid)
       Status: New => Invalid

** Visibility changed to: Public

-- 
SQL injection in username field
https://bugs.launchpad.net/bugs/556369
You received this bug notification because you are a member of Mahara
Packaging, which is subscribed to mahara in ubuntu.

Status in Mahara ePortfolio: Fix Released
Status in “mahara” package in Ubuntu: Invalid
Status in “mahara” source package in Lucid: Invalid
Status in “mahara” source package in Jaunty: Confirmed
Status in “mahara” source package in Karmic: Confirmed

Bug description:
Binary package hint: mahara

There is an exploitable SQL injection in the code used to generate new usernames.

I will attach here debdiffs for both jaunty and karmic.

For lucid, I will file a separate sync request.

( Also see upstream bug report at https://bugs.launchpad.net/mahara/+bug/534172 and the upstream security advisory at http://mahara.org/interaction/forum/topic.php?id=1713 )