Debian Security Advisory

DSA-3545-1 cgit -- security update

Date Reported:
07 Apr 2016
Affected Packages:
cgit
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 812411.
In Mitre's CVE dictionary: CVE-2016-1899, CVE-2016-1900, CVE-2016-1901.
More information:

Several vulnerabilities were discovered in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of these flaws to perform cross-site scripting, header injection or denial of service attacks.

For the stable distribution (jessie), these problems have been fixed in version 0.10.2.git2.0.1-3+deb8u1.

For the testing distribution (stretch), these problems have been fixed in version 0.12.0.git2.7.0-1 or earlier.

For the unstable distribution (sid), these problems have been fixed in version 0.12.0.git2.7.0-1 or earlier.

We recommend that you upgrade your cgit packages.