cvelist/2016/1xxx/CVE-2016-1899.json

108 lines
3.6 KiB
JSON

{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2016-1899",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a",
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
},
"vendor_name" : "n/a"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "n/a"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "[CGit] 20160113 XSS in cgit",
"refsource" : "MLIST",
"url" : "http://lists.zx2c4.com/pipermail/cgit/2016-January/002790.html"
},
{
"name" : "[CGit] 20160114 [ANNOUNCE] CGIT v0.12 Released",
"refsource" : "MLIST",
"url" : "http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html"
},
{
"name" : "[oss-security] 20160114 CVE Request: CGit - Multiple vulnerabilities",
"refsource" : "MLIST",
"url" : "http://www.openwall.com/lists/oss-security/2016/01/14/3"
},
{
"name" : "[oss-security] 20160114 Re: CVE Request: CGit - Multiple vulnerabilities",
"refsource" : "MLIST",
"url" : "http://www.openwall.com/lists/oss-security/2016/01/14/6"
},
{
"name" : "http://git.zx2c4.com/cgit/commit/?id=1c581a072651524f3b0d91f33e22a42c4166dd96",
"refsource" : "CONFIRM",
"url" : "http://git.zx2c4.com/cgit/commit/?id=1c581a072651524f3b0d91f33e22a42c4166dd96"
},
{
"name" : "DSA-3545",
"refsource" : "DEBIAN",
"url" : "http://www.debian.org/security/2016/dsa-3545"
},
{
"name" : "FEDORA-2016-215b507409",
"refsource" : "FEDORA",
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176167.html"
},
{
"name" : "FEDORA-2016-e5a5fb196f",
"refsource" : "FEDORA",
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176198.html"
},
{
"name" : "openSUSE-SU-2016:0196",
"refsource" : "SUSE",
"url" : "http://lists.opensuse.org/opensuse-updates/2016-01/msg00067.html"
},
{
"name" : "openSUSE-SU-2016:0218",
"refsource" : "SUSE",
"url" : "http://lists.opensuse.org/opensuse-updates/2016-01/msg00084.html"
}
]
}
}