CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-12976
https://notcve.org/view.php?id=CVE-2017-12976
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117. git-annex en versiones anteriores a la 6.20170818 permite que atacantes remotos ejecuten comandos arbitrarios mediante una URL ssh con un carácter de guion en el nombre de host, tal y como demuestra ssh://-eProxyCommand= URL, un problema relacionado con CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117. • http://source.git-annex.branchable.com/?p=source.git%3Ba=blob%3Bf=doc/bugs/dashed_ssh_hostname_security_hole.mdwn http://source.git-annex.branchable.com/?p=source.git%3Ba=commit%3Bh=c24d0f0e8984576654e2be149005bc884fe0403a http://source.git-annex.branchable.com/?p=source.git%3Ba=commit%3Bh=df11e54788b254efebb4898b474de11ae8d3b471 http://www.debian.org/security/2017/dsa-4010 https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 55%CPEs: 51EXPL: 20CVE-2017-1000117 – Git < 2.7.5 - Command Injection
https://notcve.org/view.php?id=CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. Un tercero malicioso puede proporcionar una URL "ssh://..." manipulada a una víctima desprevenida y un intento de visita a la URL puede resultar en que se ejecute cualquier programa que exista en la máquina de la víctima. Dicha URL podría colocarse en el archivo .gitmodules de un proyecto malicioso y una víctima desprevenida podría ser engañada para que ejecute "git clone --recurse-submodules" para desencadenar esta vulnerabilidad. • https://www.exploit-db.com/exploits/42599 https://github.com/greymd/CVE-2017-1000117 https://github.com/Manouchehri/CVE-2017-1000117 https://github.com/VulApps/CVE-2017-1000117 https://github.com/timwr/CVE-2017-1000117 https://github.com/rootclay/CVE-2017-1000117 https://github.com/ieee0824/CVE-2017-1000117 https://github.com/ieee0824/CVE-2017-1000117-sl https://github.com/AnonymKing/CVE-2017-1000117 https://github.com/nkoneko/CVE-2017-1000117 https://github.com/Shadow • CWE-20: Improper Input Validation CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 1CVE-2017-8386 – git: Escape out of git-shell
https://notcve.org/view.php?id=CVE-2017-8386
git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character. git-shell en git en versiones anteriores a la 2.4.12, versiones 2.5.x anteriores a la 2.5.6, versiones 2.6.x anteriores a la 2.6.7, versiones 2.7.x anteriores a la 2.7.5, versiones 2.8.x anteriores a la 2.8.5, versiones 2.9.x anteriores a la 2.9.4, versiones 2.10.x anteriores a la 2.10.3, versiones 2.11.x anteriores a la 2.11.2 y versiones 2.12.x anteriores a la 2.12.3 podría permitir que usuarios remotos autenticados obtengan privilegios mediante un nombre de repositorio que comienza con un carácter - (guion). A flaw was found in the way git-shell handled command-line options for the restricted set of git-shell commands. A remote, authenticated attacker could use this flaw to bypass git-shell restrictions, to view and manipulate files, by abusing the instance of the less command launched using crafted command-line options. • http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com http://www.debian.org/security/2017/dsa-3848 http://www.securityfocus.com/bid/98409 http://www.securitytracker.com/id/1038479 http://www.ubuntu.com/usn/USN-3287-1 https://access.redhat.com/errata/RHSA-2017:2004 https://access.redhat.com/errata/RHSA-2017:2491 https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2014-9938 – git: git-prompt.sh does not sanitize branch names in $PS1
https://notcve.org/view.php?id=CVE-2014-9938
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution. Contrib/completion/git-prompt.sh en Git en versiones anteriores a 1.9.3 no desinfecta nombres de sucursales en la variable PS1, permitiendo que un repositorio malicioso cause la ejecución de código. It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell to include repository information in the prompt. • https://access.redhat.com/errata/RHSA-2017:2004 https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f https://github.com/njhartwell/pw3nage https://access.redhat.com/security/cve/CVE-2014-9938 https://bugzilla.redhat.com/show_bug.cgi?id=1434415 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9274
https://notcve.org/view.php?id=CVE-2016-9274
Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory. NOTE: 2.x is unaffected. Vulnerabilidad de ruta de acceso no confiable en Git 1.x para Windows permite a los usuarios locales obtener privilegios a través de un archivo caballo de Troya git.exe en el directorio de trabajo actual. NOTA: 2.x no se ve afectada. • http://www.securityfocus.com/bid/94289 https://github.com/git-for-windows/git/issues/944 https://www.youtube.com/watch?v=S7jOLv0sul0 • CWE-426: Untrusted Search Path •