PT-2009-1075 · Git · Git
Published
2009-01-21
·
Updated
2017-08-08
·
CVE-2008-5916
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Git versions 1.6.x before 1.6.0.6
Git versions 1.5.6.x before 1.5.6.6
Git versions 1.5.5.x before 1.5.5.6
Git versions 1.5.4.x before 1.5.4.7
Git versions after 1.4.3
Description
The issue allows local repository owners to execute arbitrary commands by modifying the
diff.external configuration variable and executing a crafted gitweb query. This can lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.Recommendations
For Git versions 1.6.x before 1.6.0.6, update to version 1.6.0.6 or later.
For Git versions 1.5.6.x before 1.5.6.6, update to version 1.5.6.6 or later.
For Git versions 1.5.5.x before 1.5.5.6, update to version 1.5.5.6 or later.
For Git versions 1.5.4.x before 1.5.4.7, update to version 1.5.4.7 or later.
For Git versions after 1.4.3, update to a version that is not affected by this issue.
As a temporary workaround, consider restricting access to the
diff.external configuration variable to minimize the risk of exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Git