oss-security - Re: viewvc: CVE request: XSS and illegal characters while printing name-value pairs

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 7 Sep 2009 11:41:33 +0200
From: Alex Legler <a3li@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: viewvc: CVE request: XSS and illegal characters
 while printing name-value pairs

On Mon, 7 Sep 2009 10:52:34 +0200, Thomas Biege <thomas@...e.de> wrote:

> Hello,
> I do not have any further details, just this changelog entries:

The two commit messages have more or less detailed information:

>   * security fix: validate the 'view' parameter to avoid XSS attack

http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2214

>   * security fix: avoid printing illegal parameter names and values

http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2219

Alex

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.