schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Roundup | Roundup-tracker | * | 1.5.0 (including) |
| Roundup | Ubuntu | esm-apps/xenial | * |
| Roundup | Ubuntu | precise | * |
| Roundup | Ubuntu | trusty | * |
| Roundup | Ubuntu | wily | * |
| Roundup | Ubuntu | xenial | * |
References
- http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
- http://www.debian.org/security/2016/dsa-3502
- https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt
- http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
- http://www.debian.org/security/2016/dsa-3502
- https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt