Bug 1541854 (CVE-2018-1000021)

Summary:	CVE-2018-1000021 git: client prints server-sent ANSI escape codes to the terminal, allowing for unverified messages to potentially execute arbitrary commands
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amahdal, besser82, ccoleman, c.david86, chrisw, dedgar, dmcphers, emarquez, gscott, hhorak, jbowes, jgoulding, jorton, mickael, pcahyna, pstodulk, security-response-team, tmz, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that the Git client printed server-sent ANSI escape codes to the terminal without any sanitization, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by a MitM attacker could potentially result in code execution, arbitrary file writes, or other attacks under highly specific circumstances dependent on the usage of a vulnerable terminal emulator by the user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-01 08:41:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1541855, 1541856, 1541858, 1554769, 1554773
Bug Blocks:	1541857

Description Sam Fowler 2018-02-05 04:57:29 UTC

The Git client does not validate messages received from a Git server, and will print anything received, including ANSI escape codes, to the terminal. Under certain client environments, a malicious Git server or man-in-the-middle (MITM) could send malicious data, potentially resulting in execution of terminal escape sequences on the client machine. This could potentially result in code execution, arbitrary file writes, or other attacks when combined with the usage of vulnerable / buggy terminal emulators.

External References:

http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html

Comment 1 Sam Fowler 2018-02-05 04:58:17 UTC

Created git tracking bugs for this issue:

Affects: fedora-all [bug 1541855]

Comment 5 Todd Zullinger 2018-02-05 20:51:07 UTC

Discussion on git mailing list:

https://public-inbox.org/git/20180205204312.GB104086@aiede.svl.corp.google.com/

Comment 22 Product Security DevOps Team 2021-02-01 08:41:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-1000021