git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.

The git-annex package was found to have multiple vulnerabilities when operating on untrusted data that could lead to arbitrary command execution and encrypted data exfiltration.

CVE-2017-12976

git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.

CVE-2018-10857

git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.

CVE-2018-10859

git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex

For Debian 8 'Jessie', these problems have been fixed in version 5.20141125+oops-1+deb8u2.

We recommend that you upgrade your git-annex packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 6.20170925

- https://hackage.haskell.org/package/git-annex-6.20170925/changelog

Security fix for CVE-2017-12976.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that git-annex, a tool to manage files with git without checking their contents in, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command.

git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.

For Debian 7 'Wheezy', these problems have been fixed in version 3.20120629+deb7u1.

We recommend that you upgrade your git-annex packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git-annex fixes the following issues :

  - CVE-2017-12976: Disallow hostname starting with a dash,     which would get passed to ssh and be treated an option.
    This could be used by an attacker who provides a crafted     repository url to cause the victim to execute arbitrary     code via -oProxyCommand. (boo#1054653).

ID	Name	Product	Family	Severity
117296	Debian DLA-1495-1 : git-annex security update	Nessus	Debian Local Security Checks	high
106013	Fedora 27 : git-annex (2017-fb1ae91f46)	Nessus	Fedora Local Security Checks	high
104258	Debian DSA-4010-1 : git-annex - security update	Nessus	Debian Local Security Checks	high
104219	Debian DLA-1144-1 : git-annex security update	Nessus	Debian Local Security Checks	high
102848	openSUSE Security Update : git-annex (openSUSE-2017-986)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-12976

high

Tenable Plugins

high

high

high

high

high