This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-1899 →

DEBIAN-CVE-2016-1899

CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP resp...

Original description

The description as published by the source.

CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cgit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.git2.3.2-1.1"}]}]

Debian:13 cgit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.git2.3.2-1.1"}]}]

Debian:14 cgit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.git2.3.2-1.1"}]}]

References

advisory security-tracker.debian.org