CVE-2017-14867
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Git en versiones anteriores a la 2.10.5, las versiones 2.11.x anteriores a 2.11.4, las 2.12.x anteriores a2.12.5, las 2.13.x anteriores a 2.13.6 y las 2.14.x anteriores a 2.14.2 emplean scripts de Perl no seguros para dar soporte a subcomandos como cvsserver. Esto permite que los atacantes ejecuten comandos arbitrarios del sistema operativo mediante metacaracteres shell en un nombre de módulo. El código vulnerable puede alcanzarse mediante git-shell incluso sin soporte para CVS.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-09-28 CVE Reserved
- 2017-09-28 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (7)
URL | Tag | Source |
---|---|---|
http://www.openwall.com/lists/oss-security/2017/09/26/9 | Mailing List | |
http://www.securityfocus.com/bid/101060 | Third Party Advisory | |
http://www.securitytracker.com/id/1039431 | Third Party Advisory | |
https://bugs.debian.org/876854 | Issue Tracking | |
https://lists.debian.org/debian-security-announce/2017/msg00246.html | Mailing List | |
https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.debian.org/security/2017/dsa-3984 | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | <= 2.10.4 Search vendor "Git-scm" for product "Git" and version " <= 2.10.4" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.11.0 Search vendor "Git-scm" for product "Git" and version "2.11.0" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.11.1 Search vendor "Git-scm" for product "Git" and version "2.11.1" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.11.2 Search vendor "Git-scm" for product "Git" and version "2.11.2" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.11.3 Search vendor "Git-scm" for product "Git" and version "2.11.3" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.12.0 Search vendor "Git-scm" for product "Git" and version "2.12.0" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.12.1 Search vendor "Git-scm" for product "Git" and version "2.12.1" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.12.2 Search vendor "Git-scm" for product "Git" and version "2.12.2" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.12.3 Search vendor "Git-scm" for product "Git" and version "2.12.3" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.12.4 Search vendor "Git-scm" for product "Git" and version "2.12.4" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.13.0 Search vendor "Git-scm" for product "Git" and version "2.13.0" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.13.1 Search vendor "Git-scm" for product "Git" and version "2.13.1" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.13.2 Search vendor "Git-scm" for product "Git" and version "2.13.2" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.13.3 Search vendor "Git-scm" for product "Git" and version "2.13.3" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.13.4 Search vendor "Git-scm" for product "Git" and version "2.13.4" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.13.5 Search vendor "Git-scm" for product "Git" and version "2.13.5" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.14.0 Search vendor "Git-scm" for product "Git" and version "2.14.0" | - |
Affected
| ||||||
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.14.1 Search vendor "Git-scm" for product "Git" and version "2.14.1" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
|