CVE-2017-14867
En bref
- Source
- NVD
- EPSS
- EPSS 36.00 % · centile 98 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Faiblesses (CWE)
- CWE-78 — Injection de commande système
Références
- http://www.openwall.com/lists/oss-security/2017/09/26/9
- https://bugs.debian.org/876854
- https://lists.debian.org/debian-security-announce/2017/msg00246.html
- https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u
- http://www.securitytracker.com/id/1039431
- http://www.securityfocus.com/bid/101060
- https://www.debian.org/security/2017/dsa-3984
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-6346
- GCVE · GCVE-0-2017-14867
Avis du CERT-FR
- CERTFR-2022-AVI-650 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2020-AVI-420 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*≤ 2.10.4cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.11.3:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.12.4:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.13.5:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*cpe:2.3:a:git-scm:git:2.14.1:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |