CVEvulnerability
CVE-2017-8386
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-06-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.
Affected configurations
• git git-shell
• opensuse leap 42.1
• debian debian linux 8.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 16.10
• canonical ubuntu linux 17.04
• fedoraproject fedora 24
• fedoraproject fedora 25
• fedoraproject fedora 26
References
- http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html Mailing List, Third Party Advisory
- http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/ public-inbox.org
- http://www.debian.org/security/2017/dsa-3848 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/98409 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038479 Third Party Advisory
- http://www.ubuntu.com/usn/USN-3287-1 Exploit, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2004 access.redhat.com
- https://access.redhat.com/errata/RHSA-2017:2491 access.redhat.com
- https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ Mitigation, Third Party Advisory
- https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/201706-04 security.gentoo.org
- http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html Mailing List, Third Party Advisory
- http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/ public-inbox.org
- http://www.debian.org/security/2017/dsa-3848 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/98409 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038479 Third Party Advisory
- http://www.ubuntu.com/usn/USN-3287-1 Exploit, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2004 access.redhat.com
- https://access.redhat.com/errata/RHSA-2017:2491 access.redhat.com
- https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ Mitigation, Third Party Advisory
- https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/201706-04 security.gentoo.org