Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

Published

2017-09-29T01:34:50.047

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application git-scm git ≤ 2.10.4 Yes
Application git-scm git 2.11.0 Yes
Application git-scm git 2.11.1 Yes
Application git-scm git 2.11.2 Yes
Application git-scm git 2.11.3 Yes
Application git-scm git 2.12.0 Yes
Application git-scm git 2.12.1 Yes
Application git-scm git 2.12.2 Yes
Application git-scm git 2.12.3 Yes
Application git-scm git 2.12.4 Yes
Application git-scm git 2.13.0 Yes
Application git-scm git 2.13.1 Yes
Application git-scm git 2.13.2 Yes
Application git-scm git 2.13.3 Yes
Application git-scm git 2.13.4 Yes
Application git-scm git 2.13.5 Yes
Application git-scm git 2.14.0 Yes
Application git-scm git 2.14.1 Yes
Operating System debian debian_linux 8.0 Yes
Operating System debian debian_linux 9.0 Yes
References