[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 27 May 2013 12:01:27 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Jan Lieskovsky <jlieskov@...hat.com>,
"Jason A. Donenfeld" <Jason@...c4.com>, cgit@...ts.zx2c4.com
Subject: Re: CVE Request: cgit directory traversal
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/27/2013 06:30 AM, Jan Lieskovsky wrote:
> Thank you for the report, Jason.
>
>> Hi Kurt,
>>
>> As mentioned in early messages to oss-sec, I've inherited
>> maintainership of the cgit codebase and am gradually auditing
>> it. Today I found a nasty directory traversal:
>>
>> http://somehost/?url=/somerepo/about/../../../../etc/passwd
>>
>> This should be pretty straightforward to categorize.
>>
>> Exploitation looks like:
>> http://data.zx2c4.com/cgit-directory-traversal.png
>>
>> I've committed a fix for it here:
>> http://git.zx2c4.com/cgit/commit/?h=wip&id=babf94e04e74123eb658a823213c062663cdadd6
>
>>
> That patch doesn't seem to be applicable to cgit-0.9.1 version yet
> (there doesn't seem to be cgit_parse_readme() routine yet).
>
> Can you provide a patch that would apply against v0.9.1 version
> too? Or would this be just problem of master branch code?
>
> Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat
> Security Response Team
>
>>
>> And this fix will be in the master branch and a new release will
>> be made soon.
>>
>> Cgit by default is not vulnerable to this, and the vulnerability
>> only exists when a user has configured cgit to use a readme file
>> from a filesystem filepath instead of from the git repo itself.
>> Until a release is made, administrators are urged to disable
>> reading the readme file from a filepath, if currently enabled.
>>
>> Thanks, Jason
>>
Please use CVE-2013-2117 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRo593AAoJEBYNRVNeJnmTWKAQAJ8a7E2eRPWx8SYACGnrzkB+
Gb8yO/13gvSd1C/OwcooBPuOfASWhGbLOMRvrlKr9JzJMXTCNQ62Uz/OLB5+Vqzg
XisOlqWtIRaP2uOHzYjpO+mC1CVKYuwhLeQR8RlrD8zGlDxxVheVgwP4n7CwmOXL
kY2ZvHWq2EsmrlOS7dgRWo2mYhPOTQZ8JY3JUuFZhC4cxEgEZdv7XEJuuiWZzG8u
Ovtd8f2nt08GBbz2i/ikVCwHWDLO37Je+GsfCswuilvZFNd0V/liPEcvI5ogooxW
6NJVCnGK4+qrCIY0SarlT4keCO7TnqwD++KeHfWEsdK3aRPIpkYkBEFi/WiCY0Ki
r88x1xymNWyLdvNr0faZMw5q/DhWc9+3guv0blzzkZ71uXWChRLKgDIzTMGNHpob
nVpG436o8Atk2k4nEsTS14fuiRx7rMDQuzYJRca3/Wn+lH4DBwuZshW5w9GccgLe
xJllCgi1L7+XTwuoxxo8x6UiubXUAH4+AdxZ/G04pb96jjZAxCN5capn7BkpR6tc
R+Pc5vpKsm5fpY6uXJPpm6ZFwYT8glXJqSuR9bWCqTSAYVs1BoljvGu0aCx5MO22
cjJxYmmpOgZ5DrYNNBokOBjUlphhRYHrpqqrsc2H7w/4cmNhg/A5G624EIsxnuTW
80p0he4NPrS/pXUrBCtU
=BN+T
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
