OS command injection in Git - CVE-2017-1000117

Vulnerability identifier: #VU7889

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-1000117

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The weakness exists due to command injection flaw. A remote attacker (e.g., repository) can return a specially crafted 'ssh://' URL during 'clone' commands to execute arbitrary shell commands with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Git
Amazon Linux AMI
Debian Linux
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for x86_64
SUSE Linux
Slackware Linux
Ubuntu
Fedora
Opensuse
git (Alpine package)
rh-git29-git (Red Hat package)
git

Update to version 2.14.1.

git (Alpine package) - update to 2.8.6-r0
rh-git29-git (Red Hat package) - addressed in versions 2.9.3-3.el6, 2.9.3-3.el7
git - addressed in versions 2.9.5-1.fc25, 2.13.5-1.fc26

• Exploit #1291 - Git < 2.7.5 - Command Injection (Metasploit) (March 18, 2020)
• Exploit #1774 - Malicious Git HTTP Server For CVE-2017-1000117 (March 18, 2020)

• https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.14.1.txt

• Command execution in Git
• Slackware Linux update for git
• Red Hat update for Git
• Arch Linux update for git
• openSUSE update for git
• SUSE Linux update for git
• openSUSE update for git
• Gentoo update for Git
• Ubuntu update for Git
• Debian update for git
• Amazon Linux AMI update for git
• SUSE Linux update for git
• OS command injection in git (Alpine package)
• Arch Linux update for mercurial
• Fedora 25 update for git
• Fedora 26 update for git
• Red Hat Software Collections update for rh-git29-git