CVE-2017-8386 git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3...
HighCVSS 8.8
EPSS 12.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/git(Debian:12) | < 1:2.11.0-3 | 1:2.11.0-3 |
| debian/git(Debian:13) | < 1:2.11.0-3 | 1:2.11.0-3 |
| debian/git(Debian:14) | < 1:2.11.0-3 | 1:2.11.0-3 |
| git-shell | All versions | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.10 | No fix listed |
| Canonical Ubuntu Linux | = 17.04 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
| fedoraproject fedora | = 26 | No fix listed |
| alpine/git(Alpine:v3.3) | < 2.6.7-r0 | 2.6.7-r0 |
References
- Debian Security Tracker CVE-2017-8386 vendor-advisory
- openSUSE-SU-2017:1422 mailing-list third-party-advisory vendor-advisory
- [git] 20170510 [ANNOUNCE] Git v2.12.3 and others mailing-list
- DSA-3848 third-party-advisory vdb-entry vendor-advisory
- 98409 third-party-advisory vdb-entry
- 1038479 third-party-advisory vdb-entry
- USN-3287-1 exploit third-party-advisory vendor-advisory
- RHSA-2017:2004 vendor-advisory
- RHSA-2017:2491 vendor-advisory
- insinuator.net mitigation third-party-advisory
- kernel.googlesource.com third-party-advisory
- FEDORA-2017-01a7989fc0 vendor-advisory
- FEDORA-2017-f4319b6dfc vendor-advisory
- FEDORA-2017-7ea0e02914 vendor-advisory
- GLSA-201706-04 vendor-advisory
- security.alpinelinux.org vendor-advisory