Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.

This update for viewvc to version 1.1.26 fixes the following issues :

  - vievwc 1.1.26, including one security fix :

  - CVE-2017-5938 escape nav_data name to avoid XSS attack     (boo#1024393)

  - vievwc 1.1.25 :

  - fix _rev2optrev assertion on long input

  - license is BSD-2-Clause, package LICENSE text

  - Update viewvc.conf for Apache 2.4 syntax. 

  - viewvc 1.1.24 :

  - fix minor bug in human_readable boolean calculation

  - allow hr_funout option to apply to unidiff diffs, too

  - fix infinite loop in rcsparse

  - fix iso8601 timezone offset handling

  - add support for renamed roots

  - fix minor buglet in viewvc-install error message

Thomas Gerbet discovered that viewvc, a web interface for CVS and Subversion repositories, did not properly sanitize user input. This problem resulted in a potential Cross-Site Scripting vulnerability.

Thomas Gerbet discovered that viewvc, a web interface for CVS and Subversion repositories, did not properly sanitize user input. This issue resulted in a potential Cross-Site Scripting vulnerability.

For Debian 7 'Wheezy', these problems have been fixed in version 1.1.5-1.4+deb7u1.

We recommend that you upgrade your viewvc packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
97284	openSUSE Security Update : viewvc (openSUSE-2017-274)	Nessus	SuSE Local Security Checks	medium
97089	Debian DSA-3784-1 : viewvc - security update	Nessus	Debian Local Security Checks	medium
97088	Debian DLA-820-1 : viewvc security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-5938

medium

Tenable Plugins

medium

medium

medium