Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.

Several vulnerabilities were discovered in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of these flaws to perform cross-site scripting, header injection or denial of service attacks.

Update to 0.12. Fixes bug #1298912

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to cgit 0.12 fixes the following issues :

  - CVE-2016-1899: Reflected Cross Site Scripting and Header     Injection in Mimetype Query String

  - CVE-2016-1900: Stored Cross Site Scripting and Header     Injection in Filename Parameter

  - CVE-2016-1901: Integer Overflow resulting in Buffer     Overflow

The bundled git version was updated to 2.7.0.

Jason A. Donenfeld reports :

Reflected Cross Site Scripting and Header Injection in Mimetype Query String.

Stored Cross Site Scripting and Header Injection in Filename Parameter.

Integer Overflow resulting in Buffer Overflow.

ID	Name	Product	Family	Severity
90410	Debian DSA-3545-1 : cgit - security update	Nessus	Debian Local Security Checks	critical
89631	Fedora 23 : cgit-0.12-1.fc23 (2016-e5a5fb196f)	Nessus	Fedora Local Security Checks	critical
89492	Fedora 22 : cgit-0.12-1.fc22 (2016-215b507409)	Nessus	Fedora Local Security Checks	critical
88399	openSUSE Security Update : cgit (openSUSE-2016-86)	Nessus	SuSE Local Security Checks	critical
88136	openSUSE Security Update : cgit (openSUSE-2016-69)	Nessus	SuSE Local Security Checks	critical
88028	FreeBSD : cgit -- multiple vulnerabilities (62c0dbbd-bfce-11e5-b5fe-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-1901

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical