User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:22.214.171.124pre) Gecko/20110227 Namoroka/3.6.15pre
any cgit URL containing a hex escape like %GG, where GG is not a pair of hexadecimal digits, causes cgit.cgi to go into an infinite loop.
Affects v0.8.3.4, upstream latest-from-git, as well as versions in Fedora.
Steps to Reproduce:
1. find a cgit server and give it a request like http://git.gnome.org/browse/gdlmm/commit/?id=%gg
infloop on server, client hangs indefinitely
no server infloop, client returns error immediately
Created attachment 481360 [details]
I've assigned CVE-2011-1027 to this issue.
Please note that this is currently embargoed; Jim is trying to get in touch with upstream to alert them first. Please do NOT commit anything public regarding this; we will wait to see what upstream wants to do here first.
Thank to both of you. I started working on this in the morning after the report came in, and was glad to see an update with a CVE. Otherwise, I may have pushed an update. I'll keep my eye out for what happens here.
Jim, have you heard back from upstream regarding this yet?
Still no reply. I pinged him 8 hours ago, using his @gmail address, which is the only one I have.
Ok, thank you. Let's wait at least the weekend to see if there is a response and we can see on Monday or Tuesday whether or not to post this to oss-security and make it public.
Upstream replied. He plans to include the patch in a bugfix release to be published today.
The fix is now public, as part of today's v0.9 release:
The fix was applied to upstream version v0.8.3.5 too, in addition to v0.9. I see Todd already built 0.9 for all Fedora and EPEL branches.
Making this bug public.
v0.8.3.5 announce message mentions security impact:
0.9 has been pushed to all Fedora and EPEL branches.