A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
|http://www.securityfocus.com/bid/100283||Third Party Advisory VDB Entry|
|http://www.securitytracker.com/id/1039131||Third Party Advisory VDB Entry|
|https://security.gentoo.org/glsa/201709-10||Third Party Advisory VDB Entry|
|https://support.apple.com/HT208103||Third Party Advisory|
|https://www.exploit-db.com/exploits/42599/||Third Party Advisory VDB Entry|
|https://email@example.com/msg1466490.html||Mailing List Patch Third Party Advisory|
Configuration 1 (hide)