CVE-2017-1000117
Summary
| CVE | CVE-2017-1000117 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-10-05 01:29:00 UTC |
| Updated | 2023-11-07 02:37:00 UTC |
| Description | A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. |
Risk And Classification
Problem Types: CWE-601
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Git-scm | Git | 2.10.0 | All | All | All |
| Application | Git-scm | Git | 2.10.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.10.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.10.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.10.1 | All | All | All |
| Application | Git-scm | Git | 2.10.2 | All | All | All |
| Application | Git-scm | Git | 2.10.3 | All | All | All |
| Application | Git-scm | Git | 2.11.0 | All | All | All |
| Application | Git-scm | Git | 2.11.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.11.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.11.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.11.0 | rc3 | All | All |
| Application | Git-scm | Git | 2.11.1 | All | All | All |
| Application | Git-scm | Git | 2.11.2 | All | All | All |
| Application | Git-scm | Git | 2.12.0 | All | All | All |
| Application | Git-scm | Git | 2.12.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.12.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.12.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.12.1 | All | All | All |
| Application | Git-scm | Git | 2.12.2 | All | All | All |
| Application | Git-scm | Git | 2.12.3 | All | All | All |
| Application | Git-scm | Git | 2.13.0 | All | All | All |
| Application | Git-scm | Git | 2.13.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.13.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.13.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.13.1 | All | All | All |
| Application | Git-scm | Git | 2.13.2 | All | All | All |
| Application | Git-scm | Git | 2.13.3 | All | All | All |
| Application | Git-scm | Git | 2.13.4 | All | All | All |
| Application | Git-scm | Git | 2.14.0 | All | All | All |
| Application | Git-scm | Git | 2.14.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.14.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.8.0 | All | All | All |
| Application | Git-scm | Git | 2.8.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.8.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.8.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.8.0 | rc3 | All | All |
| Application | Git-scm | Git | 2.8.1 | All | All | All |
| Application | Git-scm | Git | 2.8.2 | All | All | All |
| Application | Git-scm | Git | 2.8.3 | All | All | All |
| Application | Git-scm | Git | 2.8.4 | All | All | All |
| Application | Git-scm | Git | 2.8.5 | All | All | All |
| Application | Git-scm | Git | 2.9.0 | All | All | All |
| Application | Git-scm | Git | 2.9.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.9.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.9.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.9.1 | All | All | All |
| Application | Git-scm | Git | 2.9.2 | All | All | All |
| Application | Git-scm | Git | 2.9.3 | All | All | All |
| Application | Git-scm | Git | 2.9.4 | All | All | All |
| Application | Git-scm | Git | 2.10.0 | All | All | All |
| Application | Git-scm | Git | 2.10.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.10.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.10.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.10.1 | All | All | All |
| Application | Git-scm | Git | 2.10.2 | All | All | All |
| Application | Git-scm | Git | 2.10.3 | All | All | All |
| Application | Git-scm | Git | 2.11.0 | All | All | All |
| Application | Git-scm | Git | 2.11.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.11.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.11.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.11.0 | rc3 | All | All |
| Application | Git-scm | Git | 2.11.1 | All | All | All |
| Application | Git-scm | Git | 2.11.2 | All | All | All |
| Application | Git-scm | Git | 2.12.0 | All | All | All |
| Application | Git-scm | Git | 2.12.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.12.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.12.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.12.1 | All | All | All |
| Application | Git-scm | Git | 2.12.2 | All | All | All |
| Application | Git-scm | Git | 2.12.3 | All | All | All |
| Application | Git-scm | Git | 2.13.0 | All | All | All |
| Application | Git-scm | Git | 2.13.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.13.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.13.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.13.1 | All | All | All |
| Application | Git-scm | Git | 2.13.2 | All | All | All |
| Application | Git-scm | Git | 2.13.3 | All | All | All |
| Application | Git-scm | Git | 2.13.4 | All | All | All |
| Application | Git-scm | Git | 2.14.0 | All | All | All |
| Application | Git-scm | Git | 2.14.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.14.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.8.0 | All | All | All |
| Application | Git-scm | Git | 2.8.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.8.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.8.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.8.0 | rc3 | All | All |
| Application | Git-scm | Git | 2.8.1 | All | All | All |
| Application | Git-scm | Git | 2.8.2 | All | All | All |
| Application | Git-scm | Git | 2.8.3 | All | All | All |
| Application | Git-scm | Git | 2.8.4 | All | All | All |
| Application | Git-scm | Git | 2.8.5 | All | All | All |
| Application | Git-scm | Git | 2.9.0 | All | All | All |
| Application | Git-scm | Git | 2.9.0 | rc0 | All | All |
| Application | Git-scm | Git | 2.9.0 | rc1 | All | All |
| Application | Git-scm | Git | 2.9.0 | rc2 | All | All |
| Application | Git-scm | Git | 2.9.1 | All | All | All |
| Application | Git-scm | Git | 2.9.2 | All | All | All |
| Application | Git-scm | Git | 2.9.3 | All | All | All |
| Application | Git-scm | Git | 2.9.4 | All | All | All |
| Application | Git-scm | Git | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [ANNOUNCE] Git v2.14.1, v2.13.5, and others | MISC | www.mail-archive.com | Mailing List, Patch, Third Party Advisory |
| [ANNOUNCE] Git v2.14.1, v2.13.5, and others | www.mail-archive.com | ||
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| About the security content of Xcode 9 - Apple Support | CONFIRM | support.apple.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Git: Command injection (GLSA 201709-10) — Gentoo Security | GENTOO | security.gentoo.org | Third Party Advisory, VDB Entry |
| Git 'ssh://' URL Processing Flaw Lets Remote Users Execute Arbitrary Commands on the Target System - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Git CVE-2017-1000117 Remote Command Injection Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Debian -- Security Information -- DSA-3934-1 git | DEBIAN | www.debian.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Git < 2.7.5 - Command Injection (Metasploit) | EXPLOIT-DB | www.exploit-db.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.