Skip to content
OpenAdvisories
Unscored CVE-2016-9646 EUVD-2016-10447GHSA-fvvm-x83v-fc5r

Commit metadata forgery via CGI::FormBuilder context-dependent APIs

Published Apr 13, 2018 · Updated Sep 16, 2024 · Assigned by debian

Description

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

Affected products

VendorProductAffectedFixed
ikiwiki ikiwiki before 3.20161229 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ikiwiki 3.20161229 —
Debian 13 ikiwiki 3.20161229 —
Debian 12 ikiwiki 3.20161229 —
Debian 8 ikiwiki 3.20141016.4 DSA-3760-1
Debian 7 ikiwiki 3.20120629.2+deb7u2 DLA-812-1
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS ikiwiki No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ikiwiki 3.20200202.3-2.7 openSUSE-SU-2024:10860-1

Advisories 3

References