PT-2017-3002 · Git+3 · Git+3

Joernchen · Published 2017-09-08 · Updated 2025-02-03 · CVE-2017-14867

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Git versions 2.10.5 and earlier, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2

Description The issue is related to the use of unsafe Perl scripts to support subcommands such as cvsserver, allowing attackers to execute arbitrary OS commands via shell metacharacters in a module name. This can be exploited remotely to execute commands as the git user. The vulnerable code can be reached via git-shell even without CVS support.

Recommendations For Git versions 2.10.5 and earlier, update to version 2.10.5 or later. For Git versions 2.11.x before 2.11.4, update to version 2.11.4 or later. For Git versions 2.12.x before 2.12.5, update to version 2.12.5 or later. For Git versions 2.13.x before 2.13.6, update to version 2.13.6 or later. For Git versions 2.14.x before 2.14.2, update to version 2.14.2 or later. As a temporary workaround, consider disabling the cvsserver subcommand until a patch is available.

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

ALT-PU-2018-1517

AZL-43047

BDU:2017-02354

CVE-2017-14867

DLA-1120-1

DSA-3984-1

MGASA-2017-0404

OPENSUSE-SU-2017_2757-1

OPENSUSE-SU-2024:10786-1

SUSE-SU-2017:2717-1

SUSE-SU-2017:2747-1

SUSE-SU-2017_2717-1

SUSE-SU-2017_2747-1

SUSE-SU-2025:20049-1

USN-3438-1

Affected Products

Alt Linux

Git

Suse

Ubuntu

References · 71

• https://nvd.nist.gov/vuln/detail/CVE-2017-14867 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:2747-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2717-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43047 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14867 · Vendor Advisory
• https://debian.org/security/2017/dsa-3984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14867 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20201207SE16MD · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3984-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3438-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14867 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10786-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0404.html · Security Note
• https://osv.dev/vulnerability/USN-3438-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0404 · Vendor Advisory