Comment 9 for bug 1254034

This bug was fixed in the package maas - 1.4+bzr1693+dfsg-0ubuntu2.3

---------------
maas (1.4+bzr1693+dfsg-0ubuntu2.3) saucy-security; urgency=low

  * SECURITY UPDATE: incorrect Content-type header allowed cross-site
    scripting vulnerability if an unknown API was used. (LP: #1251336)
    - debian/patches/CVE-2013-1070.patch: Use Content-type text/plain to force
      browsers to not render error messages as HTML.
    - CVE-2013-1070
  * SECURITY UPDATE: /etc/maas/txlongpoll.yaml contained a publicly readable
    password. (LP: #1254034)
    - debian/maas-region-controller-min.postinst: chown and chmod
      /etc/maas/txlongpoll.yaml with correct permissions
    - CVE-2013-1069
 -- Seth Arnold <email address hidden> Tue, 11 Feb 2014 12:16:40 -0800