Hi Ludovico, On Sun, Sep 03, 2017 at 05:12:15PM +0000, Ludovico Cavedon wrote: > package src:ntopng > tags 866722 + moreinfo fixed-upstream > thanks > > Hi Salvatore, > > On Sat, Jul 1, 2017 at 10:27 AM Salvatore Bonaccorso <[email protected]> > wrote: > > > CVE-2017-7416[0]: > > | ntopng before 3.0 allows XSS because GET and POST parameters are > > | improperly validated. > > > > It is unclear to me what this is about exactly. I am talking to upstream to > see if we can figure it out.
Yep, there is no much more information directly available, but upstream should be able to tell you which is/are the fixing commits. The CVE page will point you via https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7416 to https://github.com/ntop/ntopng/blob/3.0/CHANGELOG.md and there is Security Fixes Disable TLS 1.0 (vulnerable) in mongoose Disabled insecure cyphers in SSL (when using ntopng over SSL) Hardens the code to prevent SQL injections Enforce POST form CSRF to prevent programmer mistakes Strict GET and POST parameters validation to prevent XSS Prevent HTTP splitting attacks Force default admin password change and this CVE refers to "Strict GET and POST parameters validation to prevent XSS". Hope this helps so far! Salvatore
