CVE-2008-5916: Medium severity Git git vulnerability

Published Jan 21, 2009

Updated

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

Affected Software

85 affected components

Git git=1.5.4-rc1.1136.g2794

Git git=1.5.0.7

Git git=1.5.5

Git git=1.5.6.5

Git git=1.5.0-rc4

Git git=1.5.0.3

Git git=1.5.2.5

Git git=1.5.1.4

Git git=1.5.3.1

Git git=1.5.4-rc2

Git git=1.5.4.1

Git git=1.5.6.3

Git git=1.5.6.4

Git git=1.6.0.3

Git git=1.6.0.2

Git git=1.5.3.3

Git git=1.5.1.3

Git git=1.5.5.4

Git git=1.4.4.1

Git git=1.5.3-rc4

Git git=1.5.2.3

Git git=1.5.3.8

Git git=1.5.5.1

Git git=1.4.3.3

Git git=1.6.0

Git git=1.5.2.1

Git git=1.5.4.3

Git git=1.6.0-rc1

Git git=1.5.5-rc2

Git git=1.5.1.5

Git git=1.5.4.6

Git git=1.5.5.3

Git git=1.5.4-rc3

Git git=1.5.3-rc7

Git git=1.5.3.5

Git git=1.5.5.3-r1

Git git=1.4.3.1

Git git=1.5.3-rc5

Git git=1.5.2.2

Git git=1.6.0-rc3

Git git=1.5.0.2

Git git=1.5.4-rc1

Git git=1.5.0.1

Git git=1.5.0.4

Git git=1.5.5-rc3

Git git=1.6.0.5

Git git=1.6.0-rc2

Git git=1.5.4

Git git=1.5.5.2

Git git=1.5.2.4

Git git=1.4.4

Git git=1.4.4.3

Git git=1.5.0

Git git=1.4.3.2

Git git=1.5.6

Git git=1.5.1.1

Git git=1.4.4.4

Git git=1.5.2

Git git=1.6.0.1

Git git=1.5.0.6

Git git=1.5.4.4

Git git=1.5.4.2

Git git=1.5.1.2

Git git=1.5.1

Git git=1.5.4-rc0

Git git=1.5.3.2

Git git=1.5.5-rc1

Git git=1.5.0.5

Git git=1.4.3.4

Git git=1.4.3.5

Git git=1.5.0-rc3

Git git=1.5.4-rc4

Git git=1.5.3.4

Git git=1.5.1.6

Git git=1.4.4.2

Git git=1.5.3

Git git=1.6.0.4

Git git=1.5.4.5

Git git=1.5.3.6

Git git=1.5.0-rc2

Git git=1.5.3.7

Git git=1.5.6.1

Git git=1.5.4-rc5

Git git=1.5.6.2

Git git=1.5.5.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade git to a version that resolves this vulnerability.
Fixed in 1.6.0.6
Upgrade
Upgrade git to a version that resolves this vulnerability.
Fixed in 1.5.6.6
Upgrade
Upgrade git to a version that resolves this vulnerability.
Fixed in 1.5.5.6
Upgrade
Upgrade git to a version that resolves this vulnerability.
Fixed in 1.5.4.7

Event History

Jan 21, 2009

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-5916?

CVE-2008-5916 has a high severity level as it allows local repository owners to execute arbitrary commands remotely.

How do I fix CVE-2008-5916?

To fix CVE-2008-5916, you should upgrade Git to a version that addresses this vulnerability, ideally 1.6.0.6 or later.

What versions of Git are affected by CVE-2008-5916?

CVE-2008-5916 affects multiple versions of Git prior to 1.6.0.6, including several releases in the 1.5.x and 1.4.x series.

Can CVE-2008-5916 be exploited remotely?

No, CVE-2008-5916 can only be exploited locally by the repository owner modifying their configuration.

What is the recommended mitigation for CVE-2008-5916?

The best mitigation for CVE-2008-5916 is to restrict access to the Git repositories and ensure only trusted users can modify configurations.