OS command injection in Git - CVE-2017-14867

Vulnerability identifier: #VU8606

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-14867

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to execute arbitrary OS commands on vulnerable system.

The vulnerability exists due to improper input validation when processing "git-cvsserver" parameters. A remote authenticated attacker can inject arbitrary OS commands and execute them on vulnerable system with 'git' user privileges.

Git
Debian Linux
SUSE Linux
Ubuntu

Update to version 2.10.5, 2.11.4, 2.12.5, 2.13.6 or 2.14.2.

• http://www.openwall.com/lists/oss-security/2017/09/26/9

• Remote code execution in Git
• Debian update for git
• Ubuntu update for Git
• OpenSUSE Linux update for git
• SUSE Linux update for git
• SUSE Linux update for git