Open Source Vulnerability in viewvc Package
Summary
DLA-3266-1: viewvc - security update. Affects viewvc versions < 1.1.26-1+deb10u1. Fixed in 1.1.26-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The viewvc package is a web-based interface for browsing Subversion and CVS repositories. It allows users to view and navigate through version control repositories. This vulnerability affects versions prior to 1.2.3 and 1.1.30 of viewvc.
Vulnerability Detail
The vulnerability, identified as CVE-2023-22456 and CVE-2023-22464, is a cross-site scripting (XSS) vulnerability. It occurs when files with unsafe names are embedded into an HTML stream, potentially causing the browser to execute unwanted code. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted viewvc instance. However, if exploited, it could lead to unauthorized code execution or data theft.
How To Fix
Minimum fixed version
1.1.26-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade viewvcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users of the unsupported 1.0.x release lineage, a workaround is to manually HTML-escape changed paths during rendering. This can be done by editing the ViewVC EZT view templates and wrapping references to changed paths with '[format "html"]' and '[end]'. For example, '[changes.path]' becomes '[format "html"][changes.path][end]'. It is important to revert this workaround after upgrading to a patched version of viewvc to avoid double escaping of changed path names.
Conclusion
It is crucial to update to the latest version of viewvc to mitigate the risk of this vulnerability. Additionally, users of the unsupported 1.0.x release lineage should implement the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for viewvc →
FAQ
ViewVC is a web-based interface for browsing Subversion and CVS repositories. It allows users to view and navigate through version control repositories.
Versions prior to 1.2.3 and 1.1.30 of viewvc are vulnerable to this cross-site scripting (XSS) vulnerability.
The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted viewvc instance. However, if exploited, it could lead to unauthorized code execution or data theft.
To fix this vulnerability, update to at least version 1.2.3 (for 1.2.x versions) or 1.1.30 (for 1.1.x versions) of viewvc.
Yes, for users of the unsupported 1.0.x release lineage, a workaround is to manually HTML-escape changed paths during rendering. This can be done by editing the ViewVC EZT view templates and wrapping references to changed paths with '[format "html"]' and '[end]'.
Related vulnerabilities
Recent vulnerabilities recorded for viewvc.
