VDB
CVE-2011-1027
CVE-2011-1027
PUBLISHED
CVSS 5 MEDIUM
Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.
EPSS 5.19% · 90.1th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
5.19%
90.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | * |
| lars_hjemli | cgit | 0.1, 0.7.1, 0.7.2 |
| fedoraproject | fedora | 14, 15, 13 |
Timeline
- Mar 20, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Sep 7, 2023 EPSS Score
References
- FEDORA-2011-2803 vendor-advisory
- 71005 vdb
- FEDORA-2011-2790 vendor-advisory
- 46756 vdb
- ADV-2011-0667 vdb
- [oss-security] 20110307 cgit convert_query_hexchar infinite loop (CVE-2011-1027) mailing-list
- 43788 third-party-advisory
- FEDORA-2011-2815 vendor-advisory
- cgit-convertqueryhexchar-dos(65919) vdb
- https://bugzilla.redhat.com/show_bug.cgi?id=680905 url
- 43633 third-party-advisory
- [git] 20110305 [ANNOUNCE] CGIT 0.8.3.5 mailing-list
- http://hjemli.net/git/cgit/commit/?h=stable&id=fc384b16fb9787380746000d3cea2d53fccc548e url
- https://nvd.nist.gov/vuln/detail/CVE-2011-1027 advisory