Debian Security Advisory
DSA-3545-1 cgit -- security update
- Date Reported:
- 07 Apr 2016
- Affected Packages:
- cgit
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 812411.
In Mitre's CVE dictionary: CVE-2016-1899, CVE-2016-1900, CVE-2016-1901. - More information:
-
Several vulnerabilities were discovered in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of these flaws to perform cross-site scripting, header injection or denial of service attacks.
For the stable distribution (jessie), these problems have been fixed in version 0.10.2.git2.0.1-3+deb8u1.
For the testing distribution (stretch), these problems have been fixed in version 0.12.0.git2.7.0-1 or earlier.
For the unstable distribution (sid), these problems have been fixed in version 0.12.0.git2.7.0-1 or earlier.
We recommend that you upgrade your cgit packages.