CVE-2011-1027: Medium severity cgit by lars hjemli vulnerability
Off-by-one error in the convertqueryhexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.
Other sources
User-Agent: Mozilla/5.0 (X11; U; Linux x8664; en-US; rv:1.9.2.15pre) Gecko/20110227 Namoroka/3.6.15pre
any cgit URL containing a hex escape like %GG, where GG is not a pair of hexadecimal digits, causes cgit.cgi to go into an infinite loop. Affects v0.8.3.4, upstream latest-from-git, as well as versions in Fedora.
Reproducible: Always
Steps to Reproduce: 1. find a cgit server and give it a request like http://git.gnome.org/browse/gdlmm/commit/?id=%gg Actual Results: infloop on server, client hangs indefinitely
Expected Results: no server infloop, client returns error immediately
patch below
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1027?
CVE-2011-1027 has a severity level categorized as moderate due to its potential to cause denial of service.
How do I fix CVE-2011-1027?
To fix CVE-2011-1027, upgrade cgit to version 0.8.3.5 or later.
Which versions of cgit are affected by CVE-2011-1027?
CVE-2011-1027 affects all versions of cgit prior to 0.8.3.5.
What type of vulnerability is CVE-2011-1027?
CVE-2011-1027 is an off-by-one error vulnerability.
What is the impact of CVE-2011-1027 on systems?
The impact of CVE-2011-1027 on systems includes the potential to cause an infinite loop and disrupt service.