CVE-2011-1027 : Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in

Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.

Published 2011-03-20 02:00:04

Updated 2023-12-22 18:50:00

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2011-1027

Fedoraproject » Fedora » Version: 14
cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 13
cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 15
cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit
Versions up to, including, (<=) 0.8.3.4
cpe:2.3:a:lars_hjemli:cgit:*:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.3
cpe:2.3:a:lars_hjemli:cgit:0.8.3:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.2.2
cpe:2.3:a:lars_hjemli:cgit:0.8.2.2:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.3.3
cpe:2.3:a:lars_hjemli:cgit:0.8.3.3:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.1
cpe:2.3:a:lars_hjemli:cgit:0.8.1:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.3.2
cpe:2.3:a:lars_hjemli:cgit:0.8.3.2:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.3.1
cpe:2.3:a:lars_hjemli:cgit:0.8.3.1:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.7.2
cpe:2.3:a:lars_hjemli:cgit:0.7.2:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.7.1
cpe:2.3:a:lars_hjemli:cgit:0.7.1:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.4
cpe:2.3:a:lars_hjemli:cgit:0.4:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.3
cpe:2.3:a:lars_hjemli:cgit:0.3:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8
cpe:2.3:a:lars_hjemli:cgit:0.8:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.6
cpe:2.3:a:lars_hjemli:cgit:0.6:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.5
cpe:2.3:a:lars_hjemli:cgit:0.5:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.2.1
cpe:2.3:a:lars_hjemli:cgit:0.8.2.1:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.7
cpe:2.3:a:lars_hjemli:cgit:0.7:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.6.3
cpe:2.3:a:lars_hjemli:cgit:0.6.3:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.2
cpe:2.3:a:lars_hjemli:cgit:0.2:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.1
cpe:2.3:a:lars_hjemli:cgit:0.1:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.2
cpe:2.3:a:lars_hjemli:cgit:0.8.2:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.8.1.1
cpe:2.3:a:lars_hjemli:cgit:0.8.1.1:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.6.2
cpe:2.3:a:lars_hjemli:cgit:0.6.2:*:*:*:*:*:*:*
Matching versions
Lars Hjemli » Cgit » Version: 0.6.1
cpe:2.3:a:lars_hjemli:cgit:0.6.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-1027

EPSS FAQ

3.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-1027

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2011-1027

CWE-189

Assigned by: nvd@nist.gov (Primary)
CWE-193 Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1027

http://secunia.com/advisories/43788

Sign in
Broken Link;Vendor Advisory
http://www.vupen.com/english/advisories/2011/0667

Webmail | OVH- OVH
Broken Link
http://www.osvdb.org/71005

404 Not Found
Broken Link
http://article.gmane.org/gmane.comp.version-control.git/168493

Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/65919

cgit convert_query_hexchar() denial of service CVE-2011-1027 Vulnerability Report
Third Party Advisory;VDB Entry
http://openwall.com/lists/oss-security/2011/03/07/3

oss-security - cgit convert_query_hexchar infinite loop (CVE-2011-1027)
Mailing List;Patch;Third Party Advisory
http://secunia.com/advisories/43633

Sign in
Broken Link;Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html

[SECURITY] Fedora 13 Update: cgit-0.9-1.fc13
Mailing List;Patch
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html

[SECURITY] Fedora 14 Update: cgit-0.9-1.fc14
Mailing List;Patch
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html

[SECURITY] Fedora 15 Update: cgit-0.9-1.fc15
Mailing List
http://hjemli.net/git/cgit/commit/?h=stable&id=fc384b16fb9787380746000d3cea2d53fccc548e

404 Not Found
Broken Link;Patch
http://www.securityfocus.com/bid/46756

cgit 'convert_query_hexchar()' Remote Denial of Service Vulnerability
Broken Link;Exploit;Third Party Advisory;VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=680905

680905 – (CVE-2011-1027) CVE-2011-1027 cgit: invalid hex escape (e.g., %GG) in query triggers infinite loop
Exploit;Issue Tracking;Patch

Jump to

Vulnerability Details : CVE-2011-1027

Products affected by CVE-2011-1027

Exploit prediction scoring system (EPSS) score for CVE-2011-1027

CVSS scores for CVE-2011-1027

CWE ids for CVE-2011-1027

References for CVE-2011-1027