{"id":"MGASA-2020-0221","summary":"Updated viewvc packages fix security vulnerability","details":"Updated viewvc package fixes security vulnerability:\n\nViewVC before versions 1.1.28 has an XSS vulnerability in CVS\nshow_subdir_lastmod support. The impact of this vulnerability is mitigated\nby the need for an attacker to have commit privileges to a CVS repository\nexposed by an otherwise trusted ViewVC instance that also has the\n`show_subdir_lastmod` feature enabled. The attack vector involves files\nwith unsafe names (names that, when embedded into an HTML stream, would\ncause the browser to run unwanted code), which themselves can be\nchallenging to create (CVE-2020-5283).\n\nThe viewvc package has been updated to version 1.1.28, fixing this issue\nand other bugs.\n","modified":"2026-01-31T06:05:27.576771Z","published":"2020-05-24T18:04:47Z","related":["CVE-2020-5283"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2020-0221.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=26628"},{"type":"REPORT","url":"https://github.com/viewvc/viewvc/security/advisories/GHSA-xpxf-fvqv-7mfg"},{"type":"REPORT","url":"https://github.com/viewvc/viewvc/releases/tag/1.1.27"},{"type":"REPORT","url":"https://github.com/viewvc/viewvc/releases/tag/1.1.28"},{"type":"REPORT","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2Q2STF2MKT24HXZ3YZIU7CN6F6QM67I5/"}],"affected":[{"package":{"name":"viewvc","ecosystem":"Mageia:7","purl":"pkg:rpm/mageia/viewvc?arch=source&distro=mageia-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-1.mga7"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2020-0221.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}