cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

This update for cgit fixes the following issues :

The following security vulnerability was addressed :

  - CVE-2018-14912: Fixed a directory traversal     vulnerability, when enable-http-clone=1 is not turned     off (boo#1103799)

The following other changes were made :

  - Update to upstream release 1.2.1

  - syntax-highlighting: replace invalid unicode with '?'

  - ui-repolist: properly sort by age

  - ui-patch: fix crash when using path limit

This update for cgit to version 1.2.1 fixes the following issues :

The following security vulnerability was addressed :

  - CVE-2018-14912: Fixed a directory traversal     vulnerability, when enable-http-clone=1 is not turned     off (boo#1103799)

The following other changes were made :

  - Update to upstream release 1.2.1 :

  - syntax-highlighting: replace invalid unicode with '?'

  - ui-repolist: properly sort by age

  - ui-patch: fix crash when using path limit

  - Update bundled git to 2.11.1

  - Update to upstream release 1.0 :

  - Add repo.homepage/gitweb.homepage setting and homepage     tab.

  - Show reverse paths in title bar so that browser tab     shows filename.

  - Allow redirects even when caching is turned on.

  - More gracefully deal with unparsable commits.

It was discovered that there was a directory traversal vulnerability in cgit, a web frontend for Git repositories.

For Debian 8 'Jessie', this issue has been fixed in cgit version 0.10.2.git2.0.1-3+deb8u2.

We recommend that you upgrade your cgit packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jann Horn reports :

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' (default) is not turned off.

ID	Name	Product	Family	Severity
123258	openSUSE Security Update : cgit (openSUSE-2019-595)	Nessus	SuSE Local Security Checks	high
111738	openSUSE Security Update : cgit (openSUSE-2018-864)	Nessus	SuSE Local Security Checks	high
111671	openSUSE Security Update : cgit (openSUSE-2018-863)	Nessus	SuSE Local Security Checks	high
111555	Debian DLA-1459-1 : cgit security update	Nessus	Debian Local Security Checks	high
111540	FreeBSD : cgit -- directory traversal vulnerability (06c4a79b-981d-11e8-b460-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high
111536	Debian DSA-4263-1 : cgit - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-14912

high

Tenable Plugins

high

high

high

high

high

high