oss-sec mailing list archives
CVE Request: cgit command injection
From: "Jason A. Donenfeld" <Jason () zx2c4 com>
Date: Sat, 27 Oct 2012 20:10:15 -0600
Hi Kurt,
From http://git.zx2c4.com/cgit/commit/?id=7ea35f9f8ecf61ab42be9947aae1176ab6e089bd
: "syntax-highlighting.sh: Fix command injection. By not quoting the argument, an attacker with the ability to add files to the repository could pass arbitrary arguments to the highlight command, in particular, the --plug-in argument which can lead to arbitrary command execution. This patch adds simple argument quoting." The vulnerable script is not a hard requirement and is more in the "contrib" variety of things. That said, lots of users do wind up using it verbatim, as it's simple and works well, so this does affect a decent number of folks. The patch for it will be released in the upcoming cgit release, along with the previous CVE for that buffer overflow. I'll send the list an update when that release is made. Thanks, Jason
Current thread:
- CVE Request: cgit command injection Jason A. Donenfeld (Oct 27)
- Re: CVE Request: cgit command injection Kurt Seifried (Oct 27)