CVE-2009-4405: SQL Injection
Description of problem: The latest upstream version is 0.11.6 (released yesterday). The current Fedora 12 (and rawhide version) is 0.11.4.
Version-Release number of selected component (if applicable): trac-0.11.4-2.fc12.src.rpm
Expected results: To have trac 0.11.6 available for F-12 and rawhide.
Additional info:
Release notes from versions 0.11.5 and 0.11.6: ---------- http://trac.edgewall.org/browser/tags/trac-0.11.5/RELEASE ---------- Changes in 0.11.5
Implemented pre-upgrade backup support for PostgreSQL and MySQL (#2304) Fixed PostgreSQL upgrade issue (#8378) More robust diff parsing (#2672) Avoid intermittent hangs by not calling aprterminate explicitly (#7785) Fixed display of merge properties for scoped repositories #7715. ---------- http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE ---------- Changes in 0.11.6
Fixed the policy checks in report results when using alternate formats. Added a check for the "raw" role that is missing in docutils < 0.6. Re-enabled connection pooling with SQLite (#3446). Added caching of configuration options (#8510). Fixed the "database is locked" issue with SQLite (#3446, #8468). Deprecated SQLite 2.x support (#8625). Fixed hanlding of times in timezones with DST (#8240). Avoid corruption of trac.ini during write (#8623). Improved support for revision ranges in the revision log view (#8349) ----------
Other sources
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4405?
CVE-2009-4405 is classified as a moderate severity vulnerability.
How do I fix CVE-2009-4405?
To fix CVE-2009-4405, upgrade to Edgewall Trac version 0.11.6 or later.
What versions are affected by CVE-2009-4405?
CVE-2009-4405 affects Edgewall Trac versions up to 0.11.5 inclusive.
Is there a workaround for CVE-2009-4405?
A workaround for CVE-2009-4405 is not available; upgrading is recommended.
Can I check my Trac version to see if I'm vulnerable to CVE-2009-4405?
Yes, you can check your Trac version by using the command line or by accessing the web interface.