CVE-2016-1000008

Advisory

Bodhi 2.2.0 addresses CVE-2016-1000008 by disallowing the re-use of solved captchas. Additionally, the captcha is
warped to make it more difficult to solve through automation.
https://github.com/fedora-infra/bodhi/pull/857
https://github.com/fedora-infra/bodhi/commit/f0122855

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Bodhi 2.2.0 is a security and feature release, with a few bug fixes as well.

This update addresses [CVE-2016-1000008](https://github.com/fedora-infra/bodhi/pull/857) by
disallowing the re-use of solved captchas. Additionally, the captcha is
[warped](https://github.com/fedora-infra/bodhi/commit/f0122855) to make it more difficult to
solve through automation. Thanks to Patrick Uiterwijk for discovering and reporting this issue.

If you would like to read about the features and bugs fixed by this release, please see the [release notes](https://github.com/fedora-infra/bodhi/blob/2.2.0/docs/release_notes.rst).

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000008