Security update for WebYaST (important)

2013-01-2305:04:22

lists.opensuse.org

0.003 Low

EPSS

Percentile

65.4%

JSON

The hosts list used by WebYaST for connecting to it’s back
end part was modifiable allowing to point to a malicious
website which then could access all values sent by WebYaST.

The /host configuration path was removed to fix this issue.

OSVersionArchitecturePackageVersionFilename
WebYaST1.2noarchwebyast-base-ui< 0.2.63-0.6.1webyast-base-ui-0.2.63-0.6.1.noarch.rpm
SUSE Studio Standard Edition1.2noarchwebyast-base-ui< 0.2.63-0.6.1webyast-base-ui-0.2.63-0.6.1.noarch.rpm
WebYaST1.2noarchwebyast-base-ui-branding-default< 0.2.63-0.6.1webyast-base-ui-branding-default-0.2.63-0.6.1.noarch.rpm
WebYaST1.2noarchwebyast-base-ui-testsuite< 0.2.63-0.6.1webyast-base-ui-testsuite-0.2.63-0.6.1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
WebYaST	1.2	noarch	webyast-base-ui	< 0.2.63-0.6.1	webyast-base-ui-0.2.63-0.6.1.noarch.rpm
SUSE Studio Standard Edition	1.2	noarch	webyast-base-ui	< 0.2.63-0.6.1	webyast-base-ui-0.2.63-0.6.1.noarch.rpm
WebYaST	1.2	noarch	webyast-base-ui-branding-default	< 0.2.63-0.6.1	webyast-base-ui-branding-default-0.2.63-0.6.1.noarch.rpm
WebYaST	1.2	noarch	webyast-base-ui-testsuite	< 0.2.63-0.6.1	webyast-base-ui-testsuite-0.2.63-0.6.1.noarch.rpm