Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2,
    when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a ..
    (dot dot) in the url parameter. (CVE-2013-2117)

A directory traversal in cgit could be used by remote attackers to read files on the local filesystem. (CVE-2013-2117)

A directory traversal vulnerability was discovered in cgit. By default, cgit is not affected. However, if cgit is configured to use a readme file from a filesystem path instead of from the git repo itself then files outside of the repository can be read.

Refer to the discussion on oss-security for further details :

http://www.openwall.com/lists/oss-security/2013/05/25/3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401276	Alpine: multiple cgit packages: security update to 0.9.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401276	Alpine: multiple cgit packages: security update to 0.9.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
75091	openSUSE Security Update : cgit (openSUSE-SU-2013:1207-1)	Nessus	SuSE Local Security Checks	medium
67365	Fedora 17 : cgit-0.9.2-1.fc17 (2013-9522)	Nessus	Fedora Local Security Checks	medium
67360	Fedora 18 : cgit-0.9.2-1.fc18 (2013-9498)	Nessus	Fedora Local Security Checks	medium
66797	Fedora 19 : cgit-0.9.2-1.fc19 (2013-9467)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2117

high

Tenable Plugins

high

high

medium

medium

medium

medium