PT-2017-13976 · Git+3 · Git+3

Katee · Publicado 2017-10-14 · Atualizado 2024-06-15 · CVE-2017-15298

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Git versions through 2.14.2

Description The issue allows remote attackers to cause a denial of service due to memory consumption via a crafted repository. This can also impact disk consumption, although an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

Recommendations For Git versions through 2.14.2, update to a version later than 2.14.2 to resolve the issue.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2018-2090

CVE-2017-15298

MGASA-2017-0440

OPENSUSE-SU-2020:0598-1

OPENSUSE-SU-2020_0598-1

OPENSUSE-SU-2024:10786-1

SUSE-SU-2020:1121-1

USN-3829-1

Produtos afetados

Alt Linux

Git

Suse

Ubuntu

Referências · 75

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/git_submodule_url_exec.rb · Exploit
• 🔥 https://github.com/Katee/git-bomb · Exploit
• 🔥 https://github.com/Rogdham/CVE-2018-11235 · Exploit
• 🔥 https://github.com/brompwnie/cve-2020-5260 · Exploit
• 🔥 https://github.com/CHYbeta/CVE-2018-11235-DEMO · Exploit
• 🔥 https://github.com/sv3nbeast/CVE-2020-5260 · Exploit
• 🔥 https://github.com/AnonymKing/CVE-2018-17456 · Exploit
• 🔥 https://github.com/qweraqq/CVE-2018-11235-Git-Submodule-CE · Exploit
• 🔥 https://kate.io/blog/git-bomb · Exploit
• https://bugzilla.suse.com/1158789 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html · Aviso do Fabricante
• https://bugzilla.suse.com/1169786 · Nota
• https://suse.com/security/cve/CVE-2019-1354 · Nota
• https://suse.com/security/cve/CVE-2017-14867 · Nota
• https://suse.com/security/cve/CVE-2017-15298 · Nota