CVE-2019-13122: Patchwork: XSS via Message-ID

[Daniel Axtens <dja () axtens net>]

Hello,

Patchwork is a web-based patch tracking system designed to facilitate
the contribution and management of contributions to an open-source
project that uses a mailing list for contributions.
(http://jk.ozlabs.org/projects/patchwork/)

Andrew Donnellan discovered an XSS via the message-id field. A malicious
party could send a patch with a message ID that included a script
tag. Because of the quirks of the email RFCs, such a message ID can
survive being sent through many mail systems, including Gmail, and be
parsed and stored by Patchwork. When a user views a patch detail page
for the patch with this message id, the script would be run.

This is due to an erroneous mark_safe() in the template tag that
renders message IDs. This has been present since v1.1 of upstream
Patchwork, but does not affect the FreeDesktop fork.

Over the last few days, we have disclosed this bug to the admins of
patchwork instances that we could identify. Several key instances have
already been patched.

The vulnerability is fixed in Patchwork v2.1.4 and v2.0.4, which have
just been released.

Kind regards,
Daniel Axtens
Patchwork maintainer