CVE-2011-1027 (GCVE-0-2011-1027)
Vulnerability from cvelistv5 – Published: 2011-03-20 01:00 – Updated: 2024-08-06 22:14
VLAI
EPSS
VEX
Summary
Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
| http://www.osvdb.org/71005 | vdb-entryx_refsource_OSVDB |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
| http://www.securityfocus.com/bid/46756 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2011/0667 | vdb-entryx_refsource_VUPEN |
| http://openwall.com/lists/oss-security/2011/03/07/3 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/43788 | third-party-advisoryx_refsource_SECUNIA |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| https://bugzilla.redhat.com/show_bug.cgi?id=680905 | x_refsource_CONFIRM |
| http://secunia.com/advisories/43633 | third-party-advisoryx_refsource_SECUNIA |
| http://article.gmane.org/gmane.comp.version-contr… | mailing-listx_refsource_MLIST |
| http://hjemli.net/git/cgit/commit/?h=stable&id=fc… | x_refsource_CONFIRM |
Date Public
2011-03-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.171Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2011-2803",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html"
},
{
"name": "71005",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/71005"
},
{
"name": "FEDORA-2011-2790",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html"
},
{
"name": "46756",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/46756"
},
{
"name": "ADV-2011-0667",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0667"
},
{
"name": "[oss-security] 20110307 cgit convert_query_hexchar infinite loop (CVE-2011-1027)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/07/3"
},
{
"name": "43788",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43788"
},
{
"name": "FEDORA-2011-2815",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html"
},
{
"name": "cgit-convertqueryhexchar-dos(65919)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65919"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=680905"
},
{
"name": "43633",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43633"
},
{
"name": "[git] 20110305 [ANNOUNCE] CGIT 0.8.3.5",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://article.gmane.org/gmane.comp.version-control.git/168493"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hjemli.net/git/cgit/commit/?h=stable\u0026id=fc384b16fb9787380746000d3cea2d53fccc548e"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "FEDORA-2011-2803",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html"
},
{
"name": "71005",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/71005"
},
{
"name": "FEDORA-2011-2790",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html"
},
{
"name": "46756",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/46756"
},
{
"name": "ADV-2011-0667",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0667"
},
{
"name": "[oss-security] 20110307 cgit convert_query_hexchar infinite loop (CVE-2011-1027)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/07/3"
},
{
"name": "43788",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43788"
},
{
"name": "FEDORA-2011-2815",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html"
},
{
"name": "cgit-convertqueryhexchar-dos(65919)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65919"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=680905"
},
{
"name": "43633",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43633"
},
{
"name": "[git] 20110305 [ANNOUNCE] CGIT 0.8.3.5",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://article.gmane.org/gmane.comp.version-control.git/168493"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hjemli.net/git/cgit/commit/?h=stable\u0026id=fc384b16fb9787380746000d3cea2d53fccc548e"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1027",
"datePublished": "2011-03-20T01:00:00.000Z",
"dateReserved": "2011-02-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T22:14:27.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2011-1027",
"date": "2026-09-16",
"epss": "0.03746",
"percentile": "0.89303"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"0.8.3.4\", \"matchCriteriaId\": \"46B95C74-CB63-45DC-B169-128A61B746E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EED1FFDD-4C04-415A-A6D6-8DAB2998A8AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"23F704C1-4129-47D9-B844-B3E20696E36D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"434FAA85-D943-4E63-85C9-F0883CEB53E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6DF1115A-A47F-4A4F-8AED-F24302A0DF4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"374B218F-A4D0-4704-A2A8-74F8A7D5759A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED123524-4D31-469E-9B2A-504033ACFE46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EE0D9623-3291-4DD1-9966-2307F7BB20B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.6.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED6865FF-0102-46FA-8A2A-23FAC59CF1FB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.6.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F8F178CE-4D7E-41CE-AA63-78E516063A7D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FE3007F-6BDA-42FC-84E0-19E271E6577D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.7.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"69087A94-2220-4F10-ACF4-337541661A1A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.7.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7B0D564C-2F88-42E9-AF86-821DB37C8FD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3BD8D272-6729-4AEC-8058-6C6644165947\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"73FBD314-B417-4E83-827D-CC91861629B6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9AE4ADD1-765B-4E83-A918-CE0DC1B30948\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79FE9604-158B-4272-8DD2-A43CEC9885BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"545A1C08-F649-4226-852F-7AC7FFCA41ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"783F5116-FD04-4D42-8EAA-C1CEF41A0C00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B6063B5-BA90-407C-9068-A853E27C76BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4AD828C7-AC59-412C-A560-D5B944D357A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"59943A07-8B85-4EB5-B8E7-E4587D472D31\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lars_hjemli:cgit:0.8.3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF02DFB4-BA4D-4A36-9F0A-E0D04727A206\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2D59BD0-43DE-4E58-A057-640AB98359A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDE52846-24EC-4068-B788-EC7F915FFF11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9396E005-22D8-4342-9323-C7DEA379191D\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.\"}, {\"lang\": \"es\", \"value\": \"Error de superaci\\u00f3n de l\\u00edmite (off-by-one) en la funci\\u00f3n convert_query_hexchar en html.c en cgit.cgi en cgit anteriores a v0.8.3.5, permite a atacantes remotos provocar una denegaci\\u00f3n de servicio (buble infinito) a trav\\u00e9s de una cadena compuesta por un caracter \\\"%\\\" (por ciento) seguido de caracteres hexadecimales no v\\u00e1lidos, como se demostr\\u00f3 con la secuencia %gg.\"}]",
"id": "CVE-2011-1027",
"lastModified": "2024-11-21T01:25:21.613",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2011-03-20T02:00:04.017",
"references": "[{\"url\": \"http://article.gmane.org/gmane.comp.version-control.git/168493\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://hjemli.net/git/cgit/commit/?h=stable\u0026id=fc384b16fb9787380746000d3cea2d53fccc548e\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\", \"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2011/03/07/3\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/43633\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/43788\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://www.osvdb.org/71005\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securityfocus.com/bid/46756\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\", \"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2011/0667\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=680905\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/65919\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://article.gmane.org/gmane.comp.version-control.git/168493\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://hjemli.net/git/cgit/commit/?h=stable\u0026id=fc384b16fb9787380746000d3cea2d53fccc548e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2011/03/07/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/43633\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/43788\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://www.osvdb.org/71005\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securityfocus.com/bid/46756\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2011/0667\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=680905\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/65919\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-193\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2011-1027\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2011-03-20T02:00:04.017\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.\"},{\"lang\":\"es\",\"value\":\"Error de superaci\u00f3n de l\u00edmite (off-by-one) en la funci\u00f3n convert_query_hexchar en html.c en cgit.cgi en cgit anteriores a v0.8.3.5, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (buble infinito) a trav\u00e9s de una cadena compuesta por un caracter \\\"%\\\" (por ciento) seguido de caracteres hexadecimales no v\u00e1lidos, como se demostr\u00f3 con la secuencia %gg.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.8.3.4\",\"matchCriteriaId\":\"46B95C74-CB63-45DC-B169-128A61B746E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EED1FFDD-4C04-415A-A6D6-8DAB2998A8AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23F704C1-4129-47D9-B844-B3E20696E36D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"434FAA85-D943-4E63-85C9-F0883CEB53E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DF1115A-A47F-4A4F-8AED-F24302A0DF4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"374B218F-A4D0-4704-A2A8-74F8A7D5759A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED123524-4D31-469E-9B2A-504033ACFE46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE0D9623-3291-4DD1-9966-2307F7BB20B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6865FF-0102-46FA-8A2A-23FAC59CF1FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8F178CE-4D7E-41CE-AA63-78E516063A7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FE3007F-6BDA-42FC-84E0-19E271E6577D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69087A94-2220-4F10-ACF4-337541661A1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B0D564C-2F88-42E9-AF86-821DB37C8FD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BD8D272-6729-4AEC-8058-6C6644165947\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73FBD314-B417-4E83-827D-CC91861629B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AE4ADD1-765B-4E83-A918-CE0DC1B30948\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79FE9604-158B-4272-8DD2-A43CEC9885BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"545A1C08-F649-4226-852F-7AC7FFCA41ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"783F5116-FD04-4D42-8EAA-C1CEF41A0C00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B6063B5-BA90-407C-9068-A853E27C76BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AD828C7-AC59-412C-A560-D5B944D357A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59943A07-8B85-4EB5-B8E7-E4587D472D31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lars_hjemli:cgit:0.8.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF02DFB4-BA4D-4A36-9F0A-E0D04727A206\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2D59BD0-43DE-4E58-A057-640AB98359A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDE52846-24EC-4068-B788-EC7F915FFF11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9396E005-22D8-4342-9323-C7DEA379191D\"}]}]}],\"references\":[{\"url\":\"http://article.gmane.org/gmane.comp.version-control.git/168493\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://hjemli.net/git/cgit/commit/?h=stable\u0026id=fc384b16fb9787380746000d3cea2d53fccc548e\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\",\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://openwall.com/lists/oss-security/2011/03/07/3\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/43633\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/43788\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://www.osvdb.org/71005\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/46756\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\",\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.vupen.com/english/advisories/2011/0667\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=680905\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/65919\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://article.gmane.org/gmane.comp.version-control.git/168493\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://hjemli.net/git/cgit/commit/?h=stable\u0026id=fc384b16fb9787380746000d3cea2d53fccc548e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://openwall.com/lists/oss-security/2011/03/07/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/43633\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/43788\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://www.osvdb.org/71005\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/46756\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.vupen.com/english/advisories/2011/0667\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=680905\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/65919\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}",
"redhat_vex": {
"current_release_date": "2025-11-21T12:58:40+00:00",
"cve": "CVE-2011-1027",
"id": "CVE-2011-1027",
"initial_release_date": "2011-03-05T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "cgit: invalid hex escape (e.g., %GG) in query triggers infinite loop",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2011/cve-2011-1027.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2023-02-15T05:54:07Z",
"cve": "CVE-2011-1027",
"id": "CVE-2011-1027",
"initial_release_date": "2023-02-15T05:54:07Z",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2011-1027",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2011-1027.json",
"version": "2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…