CVE-2023-37901

Advisory

Indico 3.2.6 includes a fix for an XSS vulnerability. Exploitation requires someone with at least submission privileges (such as a speaker) and then rely on someone else to attempt to delete this content. However, considering that event organizers may indeed delete suspicious-looking content when encountering it, there is a non-negligible risk of such an attack to succeed.
https://github.com/indico/indico/pull/5862
https://github.com/indico/indico/security/advisories/GHSA-fmqq-25x9-c6hm

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------

*Released on July 20, 2023*

Security fixes
^^^^^^^^^^^^^^

- Fix an XSS vulnerability in various confirmation prompts commonly used when deleting
things. Exploitation requires someone with at least submission privileges (such as a
speaker) and then rely on someone else to attempt to delete this content. However,
considering that event organizers may indeed delete suspicious-looking content when
encountering it, there is a non-negligible risk of such an attack to succeed. Because
of this it is strongly recommended to upgrade as soon as possible (:pr:`5862`,
:cve:`CVE-2023-37901`)

Internationalization
^^^^^^^^^^^^^^^^^^^^

- New translation: Czech

Improvements
^^^^^^^^^^^^

- Show which files were added or modified on each editing timeline revision (:pr:`5802`)
- Support rendering Japanese, Chinese & Korean letters in PDFs (:issue:`3120`, :pr:`5842`,
thanks :user:`adamjenkins`)
- Add button to adapt columns widths on the reviewing area's abstracts list (:pr:`5837`)
- Allow cloning category-level badge/poster templates into another category (:pr:`5775`,
thanks :user:`SegiNyn`)
- Allow using a custom link text in the ``{event_link}`` email placeholder, using the
``{event_link:something-else-here}`` syntax (:issue:`5858`, :pr:`5860`)
- Add option to add "event cancelled" semantics for event labels, which will disable
reminders for events having this label (:issue:`5285`, :pr:`5861`)

Bugfixes
^^^^^^^^

- Use correct name formatting in person link fields (:pr:`5835`)

Internal Changes
^^^^^^^^^^^^^^^^

- Support Python 3.11

Resources

• https://pypi.org/project/indico
• https://pyup.io/changelogs/indico/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37901
• https://github.com/indico/indico/security/advisories/GHSA-fmqq-25x9-c6hm
• https://github.com/indico/indico/commit/2ee636d318653fb1ab193803dafbfe3e371d4130
• https://github.com/indico/indico/releases/tag/v3.2.6
• https://docs.getindico.io/en/stable/installation/upgrade/