Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2016-1899 →
DEBIAN-CVE-2016-1899
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP resp...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
cgit
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.git2.3.2-1.1"}]}]
Debian:13
cgit
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.git2.3.2-1.1"}]}]
Debian:14
cgit
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.git2.3.2-1.1"}]}]
Références
- advisory security-tracker.debian.org