CVSS: 9.0EPSS: 0%CPEs: 20EXPL: 0CVE-2017-14867
https://notcve.org/view.php?id=CVE-2017-14867
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support. Git en versiones anteriores a la 2.10.5, las versiones 2.11.x anteriores a 2.11.4, las 2.12.x anteriores a2.12.5, las 2.13.x anteriores a 2.13.6 y las 2.14.x anteriores a 2.14.2 emplean scripts de Perl no seguros para dar soporte a subcomandos como cvsserver. Esto permite que los atacantes ejecuten comandos arbitrarios del sistema operativo mediante metacaracteres shell en un nombre de módulo. El código vulnerable puede alcanzarse mediante git-shell incluso sin soporte para CVS. • http://www.openwall.com/lists/oss-security/2017/09/26/9 http://www.securityfocus.com/bid/101060 http://www.securitytracker.com/id/1039431 https://bugs.debian.org/876854 https://lists.debian.org/debian-security-announce/2017/msg00246.html https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u https://www.debian.org/security/2017/dsa-3984 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 55%CPEs: 51EXPL: 20CVE-2017-1000117 – Git < 2.7.5 - Command Injection
https://notcve.org/view.php?id=CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. Un tercero malicioso puede proporcionar una URL "ssh://..." manipulada a una víctima desprevenida y un intento de visita a la URL puede resultar en que se ejecute cualquier programa que exista en la máquina de la víctima. Dicha URL podría colocarse en el archivo .gitmodules de un proyecto malicioso y una víctima desprevenida podría ser engañada para que ejecute "git clone --recurse-submodules" para desencadenar esta vulnerabilidad. • https://www.exploit-db.com/exploits/42599 https://github.com/greymd/CVE-2017-1000117 https://github.com/Manouchehri/CVE-2017-1000117 https://github.com/VulApps/CVE-2017-1000117 https://github.com/timwr/CVE-2017-1000117 https://github.com/rootclay/CVE-2017-1000117 https://github.com/ieee0824/CVE-2017-1000117 https://github.com/ieee0824/CVE-2017-1000117-sl https://github.com/AnonymKing/CVE-2017-1000117 https://github.com/nkoneko/CVE-2017-1000117 https://github.com/Shadow • CWE-20: Improper Input Validation CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •