PT-2015-7563 · Git+5 · Git+5

Blake Burkhart · Published 2015-12-08 · Updated 2024-06-15 · CVE-2015-7545

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.3.10 Git versions 2.4.x prior to 2.4.10 Git versions 2.5.x prior to 2.5.4 Git versions 2.6.x prior to 2.6.1

Description The issue is related to the git-remote-ext and other remote helper programs in Git, which do not properly restrict allowed protocols. This might allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other sources in a submodule.

Recommendations For Git versions prior to 2.3.10, update to version 2.3.10 or later. For Git versions 2.4.x prior to 2.4.10, update to version 2.4.10 or later. For Git versions 2.5.x prior to 2.5.4, update to version 2.5.4 or later. For Git versions 2.6.x prior to 2.6.1, update to version 2.6.1 or later.

Exploit

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

ALT-PU-2015-2140

CESA-2015_2561

CVE-2015-7545

DSA-3435-1

OPENSUSE-SU-2024:10070-1

RHSA-2015:2515

RHSA-2015:2561

RHSA-2015_2561

SUSE-SU-2015:2025-1

SUSE-SU-2015:2325-1

SUSE-SU-2015_2325-1

USN-2835-1

Affected Products

Alt Linux

Centos

Git

Red Hat

Suse

Ubuntu

References · 48

• 🔥 https://hackmd.io/s/SkKL68GIe#%F0%9F%8D%8A-web-300-git · Exploit
• https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt · Vendor Advisory
• https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt · Vendor Advisory
• https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2325-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-2515.html · Vendor Advisory
• https://security.gentoo.org/glsa/201605-01 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2835-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7545 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-7545 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7545 · Security Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255 · Vendor Advisory
• http://ubuntu.com/usn/USN-2835-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2515.html · Vendor Advisory