OS Command Injection in Git client - CVE-2019-10392

Vulnerability identifier: #VU21118

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10392

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to the affected software does not properly restrict values passed as URL argument to an invocation of git "ls-remote". A remote authenticated attacker with Job/Configure permission can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Git client
Red Hat OpenShift Container Platform
toolbox (Red Hat package)
skopeo (Red Hat package)
slirp4netns (Red Hat package)
runc (Red Hat package)
podman (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
openshift-kuryr (Red Hat package)
machine-config-daemon (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-clients (Red Hat package)
dracut (Red Hat package)

Install updates from vendor's website.

Git client - update to 2.8.5
Red Hat OpenShift Container Platform - addressed in versions 4.1.38, 4.2.20, 4.3.3
toolbox (Red Hat package) - update to 0.0.6-1.rhaos4.3.el8
skopeo (Red Hat package) - update to 0.1.32-6.git1715c90.el8_0
slirp4netns (Red Hat package) - update to 0.4.2-4.git21fdece.el8
runc (Red Hat package) - update to 1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0
podman (Red Hat package) - update to 1.0.2-3.dev.git96ccc2e.el8_0
cri-o (Red Hat package) - addressed in versions 1.13.12-6.dev.rhaos4.1.git8abaaeb.el7, 1.13.12-6.dev.rhaos4.1.git8abaaeb.el8_0, 1.14.12-10.dev.rhaos4.2.git313d784.el8, 1.14.12-19.dev.rhaos4.2.git313d784.el7, 1.16.3-20.dev.rhaos4.3.git11c04e3.el7, 1.16.3-22.dev.rhaos4.3.git11c04e3.el8
cri-tools (Red Hat package) - update to 1.17.0-1.el8
jenkins (Red Hat package) - addressed in versions 2.204.1.1581950993-1.el7, 2.204.1.1581951349-1.el7, 2.204.2.1583849753-1.el7
jenkins-2-plugins (Red Hat package) - addressed in versions 3.11.1591354111-1.el7, 4.1.1583850385-1.el7, 4.2.1581952573-1.el7, 4.3.1581956184-1.el7
openshift (Red Hat package) - addressed in versions 4.1.37-202002280447.git.0.543873e.el7, 4.1.37-202002280447.git.0.543873e.el8_0, 4.2.20-202002140432.git.0.47933cb.el7, 4.2.20-202002140432.git.0.47933cb.el8, 4.3.3-202002140552.git.0.e38059c.el7, 4.3.3-202002140552.git.0.e38059c.el8
openshift-ansible (Red Hat package) - addressed in versions 4.1.37-202002280447.git.1.bb180eb.el7, 4.2.20-202002140432.git.187.2308b53.el7, 4.3.3-202002142331.git.173.bb0b5a1.el7
atomic-enterprise-service-catalog (Red Hat package) - addressed in versions 4.1.37-202003020601.git.0.5784dc4.el7, 4.2.20-202002170402.git.1.159e2f5.el7, 4.3.3-202002170501.git.1.f30799e.el7
openshift-kuryr (Red Hat package) - addressed in versions 4.2.20-202002140432.git.1.d9a72a5.el7, 4.3.3-202002170501.git.1.3b8b4cc.el8
machine-config-daemon (Red Hat package) - addressed in versions 4.2.20-202002170402.git.1.a83336a.el8, 4.3.3-202002170501.git.1.6b1b155.el8
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.2.20-202002170402.git.1.43218bc.el7, 4.3.3-202002170501.git.1.4feff9c.el7
openshift-clients (Red Hat package) - addressed in versions 4.3.3-202002140552.git.1.ff73b47.el7, 4.3.3-202002140552.git.1.ff73b47.el8
dracut (Red Hat package) - update to 049-64.git20200123.el8

• http://www.openwall.com/lists/oss-security/2019/09/12/2
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534

• Remote code execution in Git client plugin for Jenkins
• Red Hat OpenShift Container Platform 3.11 update for jenkins-2-plugins
• OS Command Injection in Red Hat OpenShift Container Platform 4.3 packages
• OS Command Injection in Red Hat OpenShift Container Platform 4.2 packages
• OS Command Injection in Red Hat OpenShift Container Platform 4.1 packages