Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1434415 - (CVE-2014-9938) CVE-2014-9938 git: git-prompt.sh does not sanitize branch names in $PS1
CVE-2014-9938 git: git-prompt.sh does not sanitize branch names in $PS1
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20140422,repor...
: Security
Depends On: 1434438 1434439 1434440 1435009
Blocks: 1434417
  Show dependency treegraph
 
Reported: 2017-03-21 09:14 EDT by Adam Mariš
Modified: 2017-08-01 16:57 EDT (History)
14 users (show)

See Also:
Fixed In Version: git 1.9.3
Doc Type: If docs needed, set a value
Doc Text:
It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell to include repository information in the prompt.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-01 16:57:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2004 normal SHIPPED_LIVE Moderate: git security and bug fix update 2017-08-01 14:33:36 EDT

  None (edit)
Description Adam Mariš 2017-03-21 09:14:46 EDT
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.

Upstream patch:

https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f

PoC repository:

https://github.com/njhartwell/pw3nage
Comment 1 Adam Mariš 2017-03-21 10:01:23 EDT
Created git tracking bugs for this issue:

Affects: epel-5 [bug 1434439]
Affects: fedora-24 [bug 1434438]
Affects: openshift-1 [bug 1434440]
Comment 2 Tomas Hoger 2017-03-22 10:38:27 EDT
Note that there are two ways to use git-prompt.sh to add info to the shell prompt.  These methods are documented at the top of the git-prompt.sh file:

#    3a) Change your PS1 to call __git_ps1 as
#        command-substitution:
#        Bash: PS1='[\u@\h \W$(__git_ps1 " (%s)")]\$ '
#        ZSH:  setopt PROMPT_SUBST ; PS1='[%n@%m %c$(__git_ps1 " (%s)")]\$ '
#        the optional argument will be used as format string.
#    3b) Alternatively, for a slightly faster prompt, __git_ps1 can
#        be used for PROMPT_COMMAND in Bash or for precmd() in Zsh
#        with two parameters, <pre> and <post>, which are strings
#        you would put in $PS1 before and after the status string
#        generated by the git-prompt machinery.  e.g.
#        Bash: PROMPT_COMMAND='__git_ps1 "\u@\h:\w" "\\\$ "'
#          will show username, at-sign, host, colon, cwd, then
#          various status string, followed by dollar and SP, as
#          your prompt.
#        ZSH:  precmd () { __git_ps1 "%n" ":%~$ " "|%s" }
#          will show username, pipe, then various status string,
#          followed by colon, cwd, dollar and SP, as your prompt.
#        Optionally, you can supply a third argument with a printf
#        format string to finetune the output of the branch status

This issue only affected uses with __git_ps1 used in the PROMPT_COMMAND (i.e. the 3b) configurations), it did not affect uses with __git_ps1 in PS1 (i.e. the 3a) configurations).

The support for using __git_ps1 in PROMPT_COMMAND was added in git version 1.8.1 via this commit:

https://github.com/git/git/commit/1bfc51ac814125de03ddf1900245e42d6ce0d250

Therefore, git 1.7.1 as shipped with Red Hat Enterprise Linux 6 was not affected.
Comment 5 errata-xmlrpc 2017-08-01 16:52:41 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2004 https://access.redhat.com/errata/RHSA-2017:2004

Note You need to log in before you can comment on or make changes to this bug.