Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2017/09/26/9 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/101060 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1039431 | Third Party Advisory VDB Entry |
| https://bugs.debian.org/876854 | Issue Tracking Mailing List Third Party Advisory |
| https://lists.debian.org/debian-security-announce/2017/msg00246.html | Mailing List Third Party Advisory |
| https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u | |
| https://www.debian.org/security/2017/dsa-3984 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Nov 2023, 02:39
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
26 Jan 2021, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:git:git:*:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.13.0:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.12.4:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.11.2:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.11.3:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.11.1:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.13.3:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.14.0:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.14.1:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.13.2:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.12.0:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.13.5:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.11.0:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.12.2:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.12.1:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.13.1:*:*:*:*:*:*:* cpe:2.3:a:git:git:2.13.4:*:*:*:*:*:*:* |
cpe:2.3:a:git-scm:git:2.14.1:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.12.4:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.11.3:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.13.5:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:* cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:* |
Information
Published : 2017-09-29 01:34
Updated : 2023-12-10 12:15
NVD link : CVE-2017-14867
Mitre link : CVE-2017-14867
CVE.ORG link : CVE-2017-14867
JSON object : View
Products Affected
git-scm
- git
debian
- debian_linux
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')