PT-2017-13976 · Git+3 · Git+3

Katee · Published 2017-10-14 · Updated 2024-06-15 · CVE-2017-15298

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Git versions through 2.14.2

Description The issue allows remote attackers to cause a denial of service due to memory consumption via a crafted repository. This can also impact disk consumption, although an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

Recommendations For Git versions through 2.14.2, update to a version later than 2.14.2 to resolve the issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2018-2090

CVE-2017-15298

MGASA-2017-0440

OPENSUSE-SU-2020:0598-1

OPENSUSE-SU-2020_0598-1

OPENSUSE-SU-2024:10786-1

SUSE-SU-2020:1121-1

USN-3829-1

Affected Products

Alt Linux

Git

Suse

Ubuntu

References · 75

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/git_submodule_url_exec.rb · Exploit
• 🔥 https://github.com/Katee/git-bomb · Exploit
• 🔥 https://github.com/Rogdham/CVE-2018-11235 · Exploit
• 🔥 https://github.com/brompwnie/cve-2020-5260 · Exploit
• 🔥 https://github.com/CHYbeta/CVE-2018-11235-DEMO · Exploit
• 🔥 https://github.com/sv3nbeast/CVE-2020-5260 · Exploit
• 🔥 https://github.com/AnonymKing/CVE-2018-17456 · Exploit
• 🔥 https://github.com/qweraqq/CVE-2018-11235-Git-Submodule-CE · Exploit
• 🔥 https://kate.io/blog/git-bomb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15298 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0440.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15298 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15298 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3829-1 · Vendor Advisory