Description
lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object. NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://viewvc.tigris.org/source/browse/viewvc?rev=1978&view=rev ↗
- http://viewvc.tigris.org/source/browse/viewvc/trunk/lib/viewvc.py?rev=2011&r1=1968&r2=1978 ↗
- http://www.openwall.com/lists/oss-security/2008/09/19/4 ↗
- http://viewvc.tigris.org/issues/show_bug.cgi?id=354 ↗
- http://www.openwall.com/lists/oss-security/2008/09/20/1 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01142.html ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01101.html ↗