[GHSA-45rp-q25w-4426] pretix: backports to 2024.5.1, 2024.6.1 not reflected

[zyl71]

Updates

• Affected products

Comments
Current record: PyPI:pretix: introduced=0 fixed=2024.7.1
Proposed: PyPI:pretix: introduced=0 fixed=2024.5.1 | introduced=2024.6.0 fixed=2024.6.1 | introduced=2024.7.0 fixed=2024.7.1

pretix fixed CVE-2024-8113 on all three supported release lines on 2024-08-23: the fix landed on master as f819f0c3, and the same escape() changes to the same four files were applied within the hour to the 2024.5, 2024.6 and 2024.7 release branches (56362cd7, d9d638a2, 0f44a2ad). The published PyPI wheels of 2024.5.1, 2024.6.1 and 2024.7.1 all carry those escape() calls; 2024.5.0, 2024.6.0 and 2024.7.0 do not. The vendor's own advisory names exactly these three fixed versions, so the single "< 2024.7.1" range wrongly flags 2024.5.1 and 2024.6.1 as vulnerable.

Release lines: master fix f819f0c3 committed 2024-08-23T12:41Z; branch commits 56362cd7 (2024.5, 12:42Z), d9d638a2 (2024.6, 13:20Z), 0f44a2ad (2024.7, 13:20Z). Lines with releases: 2024.5 (2024.5.0 vulnerable -> 2024.5.1 fixed), 2024.6 (2024.6.0 -> 2024.6.1), 2024.7 (2024.7.0 -> 2024.7.1); 2024.8.0 (2024-08-28) and later contain the master fix. All older lines (2024.4 and earlier, 2023.x, 4.x, ...) had no release after the fix and stay affected; they are covered by 0 -> 2024.5.1. No version exists between 2024.5.1 and 2024.6.0 or between 2024.6.1 and 2024.7.0, so the three ranges are gap-free.

Maintainer statement: the pretix security blog post of 2024-08-23 for CVE-2024-8113 says "Affected versions: pretix versions until 2024.7.0 are affected" and "we therefore just released versions 2024.7.1, 2024.6.1, and 2024.5.1 of pretix that fix this problem". The GHSA record only lists 2024.7.1.

Evidence:

• https://pretix.eu/about/en/blog/20240823-release-2024-7-1/ - vendor security release post naming 2024.7.1, 2024.6.1 and 2024.5.1 as fixed and "until 2024.7.0" as affected
• https://pypi.org/pypi/pretix/json - uploads: 2024.5.0 2024-05-24, 2024.5.1 2024-08-23T13:33Z, 2024.6.0 2024-06-24, 2024.6.1 2024-08-23T13:49Z, 2024.7.0 2024-07-26, 2024.7.1 2024-08-23T14:08Z
• pretix/pretix@f819f0c - fix on master: escape() added in base/forms/widgets.py, control/views/event.py, control/views/vouchers.py, plugins/sendmail/views.py
• pretix/pretix@v2024.5.0...v2024.5.1 - the 2024.5 release contains the same change (commit 56362cd7)
• pretix/pretix@v2024.6.0...v2024.6.1 - the 2024.6 release contains the same change (commit d9d638a2)
• pretix/pretix@v2024.7.0...v2024.7.1 - the 2024.7 release contains the same change (commit 0f44a2ad)

Version checks:

• pretix 2024.5.1 (PyPI 2024-08-23): fixed. Commit 56362cd7 is contained in tag v2024.5.1 and not in v2024.5.0, and the published wheel has escape(_("Sample: %s") % v) ... escape(k) at pretix/base/forms/widgets.py line 68, escape(s) and escape(str(p.render_sample(...))) in control/views/event.py, escape(s) in control/views/vouchers.py and three escape(v.render_sample(...)) calls in plugins/sendmail/views.py. The 2024.5.0 wheel still has the unescaped expression at line 67.
• pretix 2024.6.1 (PyPI 2024-08-23): fixed. Commit d9d638a2 is contained in tag v2024.6.1 and not in v2024.6.0; the wheel shows the same escaped lines. The 2024.6.0 wheel is unescaped.
• pretix 2024.7.1 (PyPI 2024-08-23): fixed. Commit 0f44a2ad is contained in tag v2024.7.1 and not in v2024.7.0; the wheel shows the same escaped lines. The 2024.7.0 wheel is unescaped.

Happy to adjust if the maintainers intend otherwise.