CVE-2017-17831 GitHub Git LFS Arbitrary command execution vulnerability
HighCVSS 8.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| git-lfs github.com/git-lfs/git-lfs/v3(Go) | < 2.1.1-0.20170519163204-f913f5f9c7c6 | 2.1.1-0.20170519163204-f913f5f9c7c6 |
| git-lfs github.com/git-lfs/git-lfs/v3(Go) | < 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible | 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible |
| git large file storage project git large file storage | < 2.1.1 | 2.1.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- confluence.atlassian.com third-party-advisory
- github.com release-notes third-party-advisory
- blog.recurity-labs.com exploit third-party-advisory
- github.com patch
- github.com patch
- pkg.go.dev
- web.archive.org
- 102926 third-party-advisory vdb-entry
- github.com
- github.com product
- Debian Security Tracker CVE-2017-17831 vendor-advisory