CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.

Several vulnerabilities were discovered in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of these flaws to perform cross-site scripting, header injection or denial of service attacks.

Update to 0.12. Fixes bug #1298912

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to cgit 0.12 fixes the following issues :

  - CVE-2016-1899: Reflected Cross Site Scripting and Header     Injection in Mimetype Query String

  - CVE-2016-1900: Stored Cross Site Scripting and Header     Injection in Filename Parameter

  - CVE-2016-1901: Integer Overflow resulting in Buffer     Overflow

The bundled git version was updated to 2.7.0.

Jason A. Donenfeld reports :

Reflected Cross Site Scripting and Header Injection in Mimetype Query String.

Stored Cross Site Scripting and Header Injection in Filename Parameter.

Integer Overflow resulting in Buffer Overflow.

ID	Name	Product	Family	Severity
90410	Debian DSA-3545-1 : cgit - security update	Nessus	Debian Local Security Checks	critical
89631	Fedora 23 : cgit-0.12-1.fc23 (2016-e5a5fb196f)	Nessus	Fedora Local Security Checks	critical
89492	Fedora 22 : cgit-0.12-1.fc22 (2016-215b507409)	Nessus	Fedora Local Security Checks	critical
88399	openSUSE Security Update : cgit (openSUSE-2016-86)	Nessus	SuSE Local Security Checks	critical
88136	openSUSE Security Update : cgit (openSUSE-2016-69)	Nessus	SuSE Local Security Checks	critical
88028	FreeBSD : cgit -- multiple vulnerabilities (62c0dbbd-bfce-11e5-b5fe-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-1899

low

Tenable Plugins

critical

critical

critical

critical

critical

critical