exploitDog

CVE-2018-17456

Опубликовано: 06 окт. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/105523
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/107511
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041811
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3408
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3505
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3541
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0316
https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404
Patch
Third Party Advisory
https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46
Patch
Third Party Advisory
https://marc.info/?l=git&m=153875888916397&w=2
Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/30
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3791-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4311
Third Party Advisory
https://www.exploit-db.com/exploits/45548/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/45631/
Exploit
Third Party Advisory
VDB Entry
https://www.openwall.com/lists/oss-security/2018/10/06/3
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Версия от 2.14.0 (включая) до 2.14.5 (исключая)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Версия от 2.15.0 (включая) до 2.15.3 (исключая)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Версия от 2.16.0 (включая) до 2.16.5 (исключая)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Версия от 2.17.0 (включая) до 2.17.2 (исключая)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Версия от 2.18.0 (включая) до 2.18.1 (исключая)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Версия от 2.19.0 (включая) до 2.19.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 4

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.707

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-88

Связанные уязвимости

CVE-2018-17456

CVSS3: 9.8

ubuntu

около 7 лет назад

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVE-2018-17456

CVSS3: 8.8

redhat

около 7 лет назад

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVE-2018-17456

CVSS3: 9.8

debian

около 7 лет назад

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x ...

openSUSE-SU-2018:4051-1

suse-cvrf

почти 7 лет назад

Security update for libgit2

openSUSE-SU-2018:3178-1

suse-cvrf

около 7 лет назад

Security update for git

EPSS

Процентиль: 99%

0.707

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-88