CVEvulnerability

CVE-2017-1000117

8.8 HIGH Published 2017-10-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-601

Description

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

Affected configurations

• git-scm git (<= 2.7.5) • git-scm git 2.8.0 • git-scm git 2.8.1 • git-scm git 2.8.2 • git-scm git 2.8.3 • git-scm git 2.8.4 • git-scm git 2.8.5 • git-scm git 2.9.0 • git-scm git 2.9.1 • git-scm git 2.9.2 • git-scm git 2.9.3 • git-scm git 2.9.4 • git-scm git 2.10.0 • git-scm git 2.10.1 • git-scm git 2.10.2 • git-scm git 2.10.3 • git-scm git 2.11.0 • git-scm git 2.11.1 • git-scm git 2.11.2 • git-scm git 2.12.0 • git-scm git 2.12.1 • git-scm git 2.12.2 • git-scm git 2.12.3 • git-scm git 2.13.0 • git-scm git 2.13.1 • git-scm git 2.13.2 • git-scm git 2.13.3 • git-scm git 2.13.4 • git-scm git 2.14.0

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References