PT-2015-7563 · Git+5 · Git+5

Blake Burkhart

·

Publicado

2015-12-08

·

Atualizado

2024-06-15

·

CVE-2015-7545

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Git versions prior to 2.3.10 Git versions 2.4.x prior to 2.4.10 Git versions 2.5.x prior to 2.5.4 Git versions 2.6.x prior to 2.6.1
Description The issue is related to the git-remote-ext and other remote helper programs in Git, which do not properly restrict allowed protocols. This might allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other sources in a submodule.
Recommendations For Git versions prior to 2.3.10, update to version 2.3.10 or later. For Git versions 2.4.x prior to 2.4.10, update to version 2.4.10 or later. For Git versions 2.5.x prior to 2.5.4, update to version 2.5.4 or later. For Git versions 2.6.x prior to 2.6.1, update to version 2.6.1 or later.

Exploit

Correção

RCE

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284CWE-20

Identificadores relacionados

ALT-PU-2015-2140
CESA-2015_2561
CVE-2015-7545
DSA-3435-1
OPENSUSE-SU-2024:10070-1
RHSA-2015:2515
RHSA-2015:2561
RHSA-2015_2561
SUSE-SU-2015:2025-1
SUSE-SU-2015:2325-1
SUSE-SU-2015_2325-1
USN-2835-1

Produtos afetados

Alt Linux
Centos
Git
Red Hat
Suse
Ubuntu