[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 24 Jul 2011 15:56:12 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Lukas Fleischer <cgit@...ptocrack.de>
CC: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request -- cGit -- XSS flaw in rename
hint
Hi Lukas,
thank you for this correction.
On 07/22/2011 10:35 PM, Lukas Fleischer wrote:
> On Fri, Jul 22, 2011 at 06:48:38PM +0200, Jan Lieskovsky wrote:
>> Hello Josh, Steve, vendors,
>>
>> an cross-site scripting (XSS) flaw was found in the way cgit, a fast
>> web interface for Git, displayed the file name in the rename hint. A
>> remote attacker could provide a specially-crafted web page, which once
>> visited by an authenticated Cgit user, with push access to the
>> repository, would lead to arbitrary web script or HTML code execution.
>
> I think you are a tad off, here. The vulnerability I discovered actually
> is only exploitable *by* a user with push access as it requires to push
> a commit that renames any file to a file with a malicious file name.
Have updated issue description in:
https://bugzilla.redhat.com/show_bug.cgi?id=725042#c0
Hoping of it to sound better now.
Thanks again && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
>
> The description (and the categorization of the vulnerability, which
> definitely is a low severity one if it counts as a vulnerability at all)
> should be corrected to reflect that.
>
>>
>> References:
>> [1] http://hjemli.net/pipermail/cgit/2011-July/000276.html
>> [2] https://bugzilla.redhat.com/show_bug.cgi?id=725042
>>
>> Could you allocate a CVE id for this?
>>
>> Thank you&& Regards, Jan.
>> --
>> Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
