Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

An update of the git package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - git: cvsserver command injection (CVE-2017-14867)

  - git: Escape out of git-shell (CVE-2017-8386)

  - Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of     service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of     disk consumption; however, an affected process typically would not survive its attempt to build the data     structure in memory before writing to disk. (CVE-2017-15298)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

  - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before     2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to     execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable     via git-shell even without CVS support. (CVE-2017-14867)

  - Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of     service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of     disk consumption; however, an affected process typically would not survive its attempt to build the data     structure in memory before writing to disk. (CVE-2017-15298)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GIT version 2.15.1 and earlier contains a Input     Validation Error vulnerability in Client that can     result in problems including messing up terminal     configuration to RCE. This attack appear to be     exploitable via The user must interact with a malicious     git server, (or have their traffic modified in a MITM     attack).(CVE-2018-1000021)

  - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before     2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2     uses unsafe Perl scripts to support subcommands such as     cvsserver, which allows attackers to execute arbitrary     OS commands via shell metacharacters in a module name.
    The vulnerable code is reachable via git-shell even     without CVS support.(CVE-2017-14867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the git packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x     before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before     2.17.1, remote code execution can occur. With a crafted     .gitmodules file, a malicious project can execute an     arbitrary script on a machine that runs 'git clone
    --recurse-submodules' because submodule 'names' are     obtained from this file, and then appended to     $GIT_DIR/modules, leading to directory traversal with     '../' in a name. Finally, post-checkout hooks from a     submodule are executed, bypassing the intended design     in which hooks are not obtained from a remote     server.(CVE-2018-11235)

  - A shell command injection flaw related to the handling     of 'ssh' URLs has been discovered in Git. An attacker     could use this flaw to execute shell commands with the     privileges of the user running the Git client, for     example, when performing a 'clone' action on a     malicious repository or a legitimate repository     containing a malicious commit.(CVE-2017-1000117)

  - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before     2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2     uses unsafe Perl scripts to support subcommands such as     cvsserver, which allows attackers to execute arbitrary     OS commands via shell metacharacters in a module name.
    The vulnerable code is reachable via git-shell even     without CVS support.(CVE-2017-14867)

  - It was found that the git-prompt.sh script shipped with     git failed to correctly handle branch names containing     special characters. A specially crafted git repository     could use this flaw to execute arbitrary commands if a     user working with the repository configured their shell     to include repository information in the     prompt.(CVE-2014-9938)

  - An integer truncation flaw and an integer overflow     flaw, both leading to a heap-based buffer overflow,     were found in the way Git processed certain path     information. A remote attacker could create a specially     crafted Git repository that would cause a Git client or     server to crash or, possibly, execute arbitrary     code.(CVE-2016-2324)

  - A flaw was found in the way the git-remote-ext helper     processed certain URLs. If a user had Git configured to     automatically clone submodules from untrusted     repositories, an attacker could inject commands into     the URL of a submodule, allowing them to execute     arbitrary code on the user's system.(CVE-2015-7545)

  - Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before     2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and     2.19.x before 2.19.1 allows remote code execution     during processing of a recursive 'git clone' of a     superproject if a .gitmodules file has a URL field     beginning with a '-' character.(CVE-2018-17456)

  - An integer truncation flaw and an integer overflow     flaw, both leading to a heap-based buffer overflow,     were found in the way Git processed certain path     information. A remote attacker could create a specially     crafted Git repository that would cause a Git client or     server to crash or, possibly, execute arbitrary     code.(CVE-2016-2315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before     2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2     uses unsafe Perl scripts to support subcommands such as     cvsserver, which allows attackers to execute arbitrary     OS commands via shell metacharacters in a module     name.(CVE-2017-14867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git fixes the following issues :

This security issue was fixed :

  - CVE-2017-14867: Git used unsafe Perl scripts to support     subcommands such as cvsserver, which allowed attackers     to execute arbitrary OS commands via shell     metacharacters in a module name (bsc#1061041).

This update was imported from the SUSE:SLE-12:Update update project.

This update for git fixes the following issues: This security issue was fixed :

  - CVE-2017-14867: Git used unsafe Perl scripts to support     subcommands such as cvsserver, which allowed attackers     to execute arbitrary OS commands via shell     metacharacters in a module name (bsc#1061041).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3438-1 advisory.

    It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker     could possibly use this issue via shell metacharacters in modules names to execute arbitrary code.

    This update also removes the cvsserver subcommand from git-shell by default.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for git to version 2.13.6 fixes the following issues :

  - CVE-2017-14867: Various Perl scripts did not use     safe_pipe_capture() instead of backticks, leaving them     susceptible to end-user input (boo#1061041)

As an additional measure, 'git cvsserver' no longer is invoked by 'git daemon' by default.

joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support has not been configured (however, the git-cvs package needs to be installed).

For Debian 7 'Wheezy', these problems have been fixed in version 1:1.7.10.4-1+wheezy6.

We recommend that you upgrade your git packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support has not been configured (however, the git-cvs package needs to be installed).

In addition to fixing the actual bug, this update removes the cvsserver subcommand from git-shell by default. Refer to the updated documentation for instructions how to reenable in case this CVS functionality is still needed.

ID	Name	Product	Family	Severity
202830	Photon OS 1.0: Git PHSA-2017-0038	Nessus	PhotonOS Local Security Checks	high
198971	RHEL 6 : git (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198930	RHEL 7 : git (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
135580	SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)	Nessus	SuSE Local Security Checks	critical
130862	EulerOS 2.0 SP5 : git (EulerOS-SA-2019-2153)	Nessus	Huawei Local Security Checks	high
124923	EulerOS Virtualization 3.0.1.0 : git (EulerOS-SA-2019-1420)	Nessus	Huawei Local Security Checks	critical
104291	EulerOS 2.0 SP2 : git (EulerOS-SA-2017-1266)	Nessus	Huawei Local Security Checks	high
104290	EulerOS 2.0 SP1 : git (EulerOS-SA-2017-1265)	Nessus	Huawei Local Security Checks	high
104077	openSUSE Security Update : git (openSUSE-2017-1167)	Nessus	SuSE Local Security Checks	high
103918	SUSE SLES12 Security Update : git (SUSE-SU-2017:2747-1)	Nessus	SuSE Local Security Checks	high
103691	Ubuntu 14.04 LTS / 16.04 LTS : Git vulnerability (USN-3438-1)	Nessus	Ubuntu Local Security Checks	high
103622	openSUSE Security Update : git (openSUSE-2017-1115)	Nessus	SuSE Local Security Checks	high
103607	Debian DLA-1120-1 : git security update	Nessus	Debian Local Security Checks	high
103473	Debian DSA-3984-1 : git - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-14867

high

Tenable Plugins

high

high

high

critical

high

critical

high

high

high

high

high

high

high

high