VDB
CVE-2011-1027
CVE-2011-1027
PUBLISHED
CVSS 5 MEDIUM
Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.
EPSS 3.75% · 89.8th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
3.75%
89.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | * |
| lars_hjemli | cgit | 0.1, 0.7.1, 0.7.2 |
| fedoraproject | fedora | 14, 15, 13 |
Timeline
- Mar 20, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
- Sep 11, 2023 EPSS Score
References
- FEDORA-2011-2803 vendor-advisory
- [oss-security] 20110307 cgit convert_query_hexchar infinite loop (CVE-2011-1027) mailing-list
- cgit-convertqueryhexchar-dos(65919) vdb
- https://bugzilla.redhat.com/show_bug.cgi?id=680905 url
- http://hjemli.net/git/cgit/commit/?h=stable&id=fc384b16fb9787380746000d3cea2d53fccc548e url
- ADV-2011-0667 vdb
- FEDORA-2011-2815 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2011-1027 advisory
- http://www.securityfocus.com/bid/46756 url
- http://article.gmane.org/gmane.comp.version-control.git/168493 technical
- http://secunia.com/advisories/43788 technical
- http://www.osvdb.org/71005 technical
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html mailing_list
- http://secunia.com/advisories/43633 technical