CVE-2017-14867
Summary
| CVE | CVE-2017-14867 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-09-29 01:34:00 UTC |
| Updated | 2023-11-07 02:39:00 UTC |
| Description | Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Git-scm | Git | 2.11.0 | All | All | All |
| Application | Git-scm | Git | 2.11.1 | All | All | All |
| Application | Git-scm | Git | 2.11.2 | All | All | All |
| Application | Git-scm | Git | 2.11.3 | All | All | All |
| Application | Git-scm | Git | 2.12.0 | All | All | All |
| Application | Git-scm | Git | 2.12.1 | All | All | All |
| Application | Git-scm | Git | 2.12.2 | All | All | All |
| Application | Git-scm | Git | 2.12.3 | All | All | All |
| Application | Git-scm | Git | 2.12.4 | All | All | All |
| Application | Git-scm | Git | 2.13.0 | All | All | All |
| Application | Git-scm | Git | 2.13.1 | All | All | All |
| Application | Git-scm | Git | 2.13.2 | All | All | All |
| Application | Git-scm | Git | 2.13.3 | All | All | All |
| Application | Git-scm | Git | 2.13.4 | All | All | All |
| Application | Git-scm | Git | 2.13.5 | All | All | All |
| Application | Git-scm | Git | 2.14.0 | All | All | All |
| Application | Git-scm | Git | 2.14.1 | All | All | All |
| Application | Git-scm | Git | 2.11.0 | All | All | All |
| Application | Git-scm | Git | 2.11.1 | All | All | All |
| Application | Git-scm | Git | 2.11.2 | All | All | All |
| Application | Git-scm | Git | 2.11.3 | All | All | All |
| Application | Git-scm | Git | 2.12.0 | All | All | All |
| Application | Git-scm | Git | 2.12.1 | All | All | All |
| Application | Git-scm | Git | 2.12.2 | All | All | All |
| Application | Git-scm | Git | 2.12.3 | All | All | All |
| Application | Git-scm | Git | 2.12.4 | All | All | All |
| Application | Git-scm | Git | 2.13.0 | All | All | All |
| Application | Git-scm | Git | 2.13.1 | All | All | All |
| Application | Git-scm | Git | 2.13.2 | All | All | All |
| Application | Git-scm | Git | 2.13.3 | All | All | All |
| Application | Git-scm | Git | 2.13.4 | All | All | All |
| Application | Git-scm | Git | 2.13.5 | All | All | All |
| Application | Git-scm | Git | 2.14.0 | All | All | All |
| Application | Git-scm | Git | 2.14.1 | All | All | All |
| Application | Git-scm | Git | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Git Command Injection Bug in 'git-cvsserver' Lets Remote Authenticated Users Gain Elevated Privileges - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| [ANNOUNCE] Git v2.13.6 and others | public-inbox.org | ||
| [ANNOUNCE] Git v2.13.6 and others | CONFIRM | public-inbox.org | Mailing List, Vendor Advisory |
| Debian -- Security Information -- DSA-3984-1 git | DEBIAN | www.debian.org | Third Party Advisory |
| #876854 - git: CVE-2017-14867: cvsserver OS command injection - Debian Bug report logs | CONFIRM | bugs.debian.org | Issue Tracking, Mailing List, Third Party Advisory |
| Malformed Request | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| [SECURITY] [DSA 3984-1] git security update | CONFIRM | lists.debian.org | Mailing List, Third Party Advisory |
| oss-security - Advisory: Git cvsserver OS Command Injection | CONFIRM | www.openwall.com | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.