SID-00289: CVE-2009-1339 Vulnerability Fix for TWiki TWiki 4.1.x Sites?

Status:	Answered	TWiki version:	4.1.2	Perl version:	5.8.5
Category:	CategorySecurity	Server OS:	RHEL 4u7	Last update:	16 years ago

There is a patch, and a hotfix, available for CVE-2009-1339 for TWiki 4.2.x and 4.3.x. But what about TWiki 4.1.x? How can I protect my 4.1.2 site against this vulnerability?

-- JohnDeStefano - 2009-04-29

Discussion and Answer

See Codev.SecurityAlert-CVE-2009-1339. Apply the minimal hotfix for TWiki-4.1.x, we have not tested it on pre-4.2 releases, but it should work since no Perl source code change is needed. Upgrade to TWiki-4.3.1 recommended.

-- PeterThoeny - 2009-04-29

Thanks Peter. But that patch may not work, as some of the form code lines in 4.1 are GETs where in 4.2/4.3 they are originally no action and are being changed to POSTs by the patch. If you're saying that these should be changed from GETs to POSTs in 4.1.x, I can try that, but I am concerned about breaking something ...

Also eager to upgrade to the current version; please see my recent question on that as well.

-- JohnDeStefano - 2009-04-29

All form actions calling the save script need to be changed to "post" method.

-- PeterThoeny - 2009-06-02

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.