Bug 1541854 (CVE-2018-1000021) - CVE-2018-1000021 git: client prints server-sent ANSI escape codes to the terminal, allowing for unverified messages to potentially execute arbitrary commands
Summary: CVE-2018-1000021 git: client prints server-sent ANSI escape codes to the term...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-1000021
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1541855 1541856 1541858 1554769 1554773
Blocks: 1541857
TreeView+ depends on / blocked
 
Reported: 2018-02-05 04:57 UTC by Sam Fowler
Modified: 2022-03-13 14:40 UTC (History)
19 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that the Git client printed server-sent ANSI escape codes to the terminal without any sanitization, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by a MitM attacker could potentially result in code execution, arbitrary file writes, or other attacks under highly specific circumstances dependent on the usage of a vulnerable terminal emulator by the user.
Clone Of:
Environment:
Last Closed: 2021-02-01 08:41:40 UTC


Attachments (Terms of Use)

Description Sam Fowler 2018-02-05 04:57:29 UTC
The Git client does not validate messages received from a Git server, and will print anything received, including ANSI escape codes, to the terminal. Under certain client environments, a malicious Git server or man-in-the-middle (MITM) could send malicious data, potentially resulting in execution of terminal escape sequences on the client machine. This could potentially result in code execution, arbitrary file writes, or other attacks when combined with the usage of vulnerable / buggy terminal emulators.

External References:

http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html

Comment 1 Sam Fowler 2018-02-05 04:58:17 UTC
Created git tracking bugs for this issue:

Affects: fedora-all [bug 1541855]

Comment 5 Todd Zullinger 2018-02-05 20:51:07 UTC
Discussion on git mailing list:

https://public-inbox.org/git/20180205204312.GB104086@aiede.svl.corp.google.com/

Comment 22 Product Security DevOps Team 2021-02-01 08:41:40 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-1000021


Note You need to log in before you can comment on or make changes to this bug.