Input validation error in Mercurial - CVE-2015-7545
Published: April 13, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32315
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-7545
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Affected software
Mercurial
Amazon Linux AMI
Gentoo Linux
Fedora
Slackware Linux
mercurial (Alpine package)
git (Alpine package)
git
Amazon Linux AMI
Gentoo Linux
Fedora
Slackware Linux
mercurial (Alpine package)
git (Alpine package)
git
How to mitigate CVE-2015-7545
Install update from vendor's website.
Mercurial - addressed in versions 2.5.4, 2.6.1
mercurial (Alpine package) - update to 3.4-r1
git (Alpine package) - update to 2.4.1-r1
git - addressed in versions 1.8.2.1-2.el5, 2.1.0-6.fc21, 2.4.3-7.fc22, 2.5.0-2.fc23
mercurial (Alpine package) - update to 3.4-r1
git (Alpine package) - update to 2.4.1-r1
git - addressed in versions 1.8.2.1-2.el5, 2.1.0-6.fc21, 2.4.3-7.fc22, 2.5.0-2.fc23
External References
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html
- http://rhn.redhat.com/errata/RHSA-2015-2515.html
- http://www.debian.org/security/2016/dsa-3435
- http://www.openwall.com/lists/oss-security/2015/12/08/5
- http://www.openwall.com/lists/oss-security/2015/12/09/8
- http://www.openwall.com/lists/oss-security/2015/12/11/7
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/78711
- http://www.securitytracker.com/id/1034501
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255
- http://www.ubuntu.com/usn/USN-2835-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1269794
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt
- https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021
- https://lkml.org/lkml/2015/10/5/683
- https://security.gentoo.org/glsa/201605-01
Related Security Bulletins
- Input validation error in Mercurial
- Input validation error in mercurial (Alpine package)
- Input validation error in git (Alpine package)
- Amazon Linux AMI update for git
- Gentoo update for Git
- Slackware Linux update for mercurial
- Fedora 21 update for git
- Fedora 23 update for git
- Fedora 22 update for git
- Fedora EPEL 5 update for git