Bug 1480386 (CVE-2017-1000117) - CVE-2017-1000117 git: Command injection via malicious ssh URLs
Summary: CVE-2017-1000117 git: Command injection via malicious ssh URLs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-1000117
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1480387 1480388 1480504 1480505 1480634 1480635
Blocks: 1480393 1481834
TreeView+ depends on / blocked
 
Reported: 2017-08-10 23:54 UTC by Trevor Jay
Modified: 2021-08-26 18:00 UTC (History)
31 users (show)

Fixed In Version: git 2.7.6, git 2.8.6, git 2.9.5, git 2.10.4, git 2.11.3, git 2.12.4, git 2.13.5, git 2.14.1
Clone Of:
Environment:
Last Closed: 2019-06-08 03:20:21 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2484 0 normal SHIPPED_LIVE Important: git security update 2017-08-17 03:04:03 UTC
Red Hat Product Errata RHSA-2017:2485 0 normal SHIPPED_LIVE Important: git security update 2017-08-17 03:26:44 UTC
Red Hat Product Errata RHSA-2017:2491 0 normal SHIPPED_LIVE Important: rh-git29-git security update 2017-08-18 01:56:10 UTC
Red Hat Product Errata RHSA-2017:2674 0 normal SHIPPED_LIVE Important: Red Hat Mobile Application Platform security update 2017-09-18 13:00:07 UTC
Red Hat Product Errata RHSA-2017:2675 0 normal SHIPPED_LIVE Important: Red Hat Mobile Application Platform security update 2017-09-18 11:19:55 UTC

Description Trevor Jay 2017-08-10 23:54:57 UTC 
A flaw was found in the way the Git client handles "ssh://" URLs. A maliciously crafted "ssh://" URL would cause Git clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious users committing to an honest server (to attack another user of that server's repositories), or by a proxy server.
Comment 6 Stefan Cornelius 2017-08-11 12:17:51 UTC 
External References:

https://lkml.org/lkml/2017/8/10/757
http://blog.recurity-labs.com/2017-08-10/scm-vulns
Comment 10 Todd Zullinger 2017-08-12 16:24:10 UTC 
Updates for Fedora 25 and 26 were pushed while this bug was being created.  I don't see any Fedora tracker bugs.  For Fedora users who search by the CVE and want to find the updates for testing, here are the links:

https://bodhi.fedoraproject.org/updates/FEDORA-2017-b1b3ae6666
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8ba7572cfd
Comment 11 Fedora Update System 2017-08-13 20:55:17 UTC 
git-2.13.5-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2017-08-14 00:55:38 UTC 
git-2.9.5-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2017-08-16 23:04:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2484 https://access.redhat.com/errata/RHSA-2017:2484
Comment 14 errata-xmlrpc 2017-08-16 23:27:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:2485 https://access.redhat.com/errata/RHSA-2017:2485
Comment 15 errata-xmlrpc 2017-08-17 21:56:58 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2017:2491 https://access.redhat.com/errata/RHSA-2017:2491
Comment 17 errata-xmlrpc 2017-09-18 06:33:43 UTC 
This issue has been addressed in the following products:

  Red Hat Mobile Application Platform 4.5

Via RHSA-2017:2675 https://access.redhat.com/errata/RHSA-2017:2675
Comment 18 errata-xmlrpc 2017-09-18 09:01:45 UTC 
This issue has been addressed in the following products:

  Red Hat Mobile Application Platform 4.5

Via RHSA-2017:2674 https://access.redhat.com/errata/RHSA-2017:2674
Note You need to log in before you can comment on or make changes to this bug.