CVSS: 9.8EPSS: 2%CPEs: 4EXPL: 0CVE-2018-19486 – git: Improper handling of PATH allows for commands to be executed from the current directory
https://notcve.org/view.php?id=CVE-2018-19486
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017. Git, en versiones anteriores a la 2.19.2 en Linux y UNIX, ejecuta comandos desde el directorio de trabajo actual (como si '.' estuviera al final de $PATH) en determinados casos relacionados con la API run_command() y run-command.c, debido a un cambio peligroso desde execvp hasta execv en el 2017. • http://www.securityfocus.com/bid/106020 http://www.securitytracker.com/id/1042166 https://access.redhat.com/errata/RHSA-2018:3800 https://git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60 https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt https://security.gentoo.org/glsa/201904-13 https://usn.ubuntu.com/3829-1 https://access.redhat.com/security/cve/CVE-2018-19486 https://bugzilla.redhat.com/show_bug.cgi& • CWE-426: Untrusted Search Path •
CVSS: 9.8EPSS: 27%CPEs: 24EXPL: 7CVE-2018-17456 – Git Submodule - Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character. Git en versiones anteriores a la 2.14.5, versiones 2.15.x anteriores a la 2.15.3, versiones 2.16.x anteriores a la 2.16.5, versiones 2.17.x anteriores a la 2.17.2, versiones 2.18.x anteriores a la 2.18.1 y versiones 2.19.x anteriores a la 2.19.1 permite la ejecución remota de código durante el procesamiento de un "clon de git" recursivo de un superproyecto si un archivo .gitmodules tiene un campo URL que comienza por un carácter "-". An option injection flaw has been discovered in git when it recursively clones a repository with sub-modules. A remote attacker may configure a malicious repository and trick a user into recursively cloning it, thus executing arbitrary commands on the victim's machine. • https://www.exploit-db.com/exploits/45631 https://www.exploit-db.com/exploits/45548 https://github.com/AnonymKing/CVE-2018-17456 https://github.com/matlink/CVE-2018-17456 https://github.com/shpik-kr/CVE-2018-17456 https://github.com/799600966/CVE-2018-17456 https://github.com/KKkai0315/CVE-2018-17456 http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html http:/ • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 8.8EPSS: 2%CPEs: 17EXPL: 14CVE-2018-11235 – git: arbitrary code execution when recursively cloning a malicious repository
https://notcve.org/view.php?id=CVE-2018-11235
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. En Git, en versiones anteriores a la 2.13.7, versiones 2.14.x anteriores a la 2.14.4, versiones 2.15.x anteriores a la 2.15.2, versiones 2.16.x anteriores a la 2.16.4 y versiones 2.17.x anteriores a la 2.17.1, puede ocurrir una ejecución remota de código. Con un archivo .gitmodules manipulado, un proyecto malicioso puede ejecutar un script arbitrario en una máquina que ejecuta "git clone --recurse-submodules" debido a que se obtienen "nombres" de subdominios de este archivo y luego se anexa a $GIT_DIR/modules, lo que conduce a un salto de directorio con "../" en un nombre. • https://github.com/Rogdham/CVE-2018-11235 https://github.com/CHYbeta/CVE-2018-11235-DEMO https://github.com/qweraqq/CVE-2018-11235-Git-Submodule-CE https://github.com/j4k0m/CVE-2018-11235 https://github.com/knqyf263/CVE-2018-11235 https://github.com/AnonymKing/CVE-2018-11235 https://github.com/ygouzerh/CVE-2018-11235 https://github.com/vmotos/CVE-2018-11235 https://github.com/xElkomy/CVE-2018-11235 https://github.com/jhswartz/CVE-2018-11235 https://github.com&#x • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2018-11233 – git: path sanity check in is_ntfs_dotgit() can read arbitrary memory
https://notcve.org/view.php?id=CVE-2018-11233
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory. En Git, en versiones anteriores a la 2.13.7, versiones 2.14.x anteriores a la 2.14.4, versiones 2.15.x anteriores a la 2.15.2, versiones 2.16.x anteriores a la 2.16.4 y versiones 2.17.x anteriores a la 2.17.1, el código para comprobar el saneamiento de los nombres de ruta en NTFS puede resultar en la lectura de memoria fuera de límites. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html http://www.securityfocus.com/bid/104346 http://www.securitytracker.com/id/1040991 https://access.redhat.com/errata/RHSA-2018:2147 https://marc.info/?l=git&m=152761328506724&w=2 https://security.gentoo.org/glsa/201805-13 https://usn.ubuntu.com/3671-1 https://access.redhat.com/security/cve/CVE-2018-11233 https://bugzilla.redhat.com/show_bug.cgi?id=1583888 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000021
https://notcve.org/view.php?id=CVE-2018-1000021
GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack). GIT, en versiones 2.15.1 y anteriores, contiene una vulnerabilidad de error de validación de entradas en Client que puede resultar en problemas que incluyen errores de configuración de terminal en RCE. Parece ser que este ataque puede ser explotado mediante un usuario que interactúe con un servidor git malicioso (o que haga que el tráfico se modifique en un ataque MITM). • http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html • CWE-20: Improper Input Validation •