—

PYSEC-2012-10

Quick fix

PYSEC-2012-10 — moin: upgrade to the fixed version with the command below.

pip install --upgrade 'moin>=1.9.5'

Details

security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/moin

Introduced in: 1.9Fixed in: 1.9.5

Fixpip install --upgrade 'moin>=1.9.5'

References

http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16[WEB]
http://moinmo.in/SecurityFixes[WEB]
http://www.debian.org/security/2012/dsa-2538[ADVISORY]
http://secunia.com/advisories/50496[ADVISORY]
http://www.openwall.com/lists/oss-security/2012/09/05/2[WEB]
http://www.openwall.com/lists/oss-security/2012/09/04/4[WEB]
http://secunia.com/advisories/50474[ADVISORY]
http://www.ubuntu.com/usn/USN-1604-1[ADVISORY]
http://secunia.com/advisories/50885[ADVISORY]
https://github.com/advisories/GHSA-g4mx-rm5q-vh24[ADVISORY]