CVE-2012-0465

Publication date 27 April 2012

Last updated 24 July 2024


Ubuntu priority

Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication requests with (1) different IP address strings in this header or (2) a long string in this header.

Status

Package Ubuntu Release Status
bugzilla 13.10 saucy Not in release
13.04 raring Not in release
12.10 quantal Not in release
12.04 LTS precise Not in release
11.10 oneiric Ignored end of life
11.04 natty Ignored end of life
10.04 LTS lucid Ignored end of life
8.04 LTS hardy Ignored end of life