CVE-2015-7545: Input Validation
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Other sources
The following issue was fixed in Git version 2.6.1:
Some protocols (like git-remote-ext) can execute arbitrary code found in the URL. The URLs that submodules use may come from arbitrary sources (e.g., .gitmodules files in a remote repository), and can hurt those who blindly enable recursive fetch. Restrict the allowed protocols to well known and safe ones.
Upstream patches:
https://kernel.googlesource.com/pub/scm/git/git/+/a5adaced2e13c135d5d9cc65be9eb95aa3bacedf%5E%21/ https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021%5E%21/ https://kernel.googlesource.com/pub/scm/git/git/+/5088d3b38775f8ac12d7f77636775b16059b67ef%5E%21/ https://kernel.googlesource.com/pub/scm/git/git/+/f4113cac0c88b4f36ee6f3abf3218034440a68e3%5E%21/ https://kernel.googlesource.com/pub/scm/git/git/+/b258116462399b318c86165c61a5c7123043cfd4%5E%21/
CVE request:
http://seclists.org/oss-sec/2015/q4/37
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7545?
CVE-2015-7545 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2015-7545?
To fix CVE-2015-7545, update Git to version 2.6.1 or later.
Which versions of Git are affected by CVE-2015-7545?
CVE-2015-7545 affects Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1.
What type of attack does CVE-2015-7545 enable?
CVE-2015-7545 could allow attackers to execute arbitrary code through specially crafted URLs in .gitmodules files.
Is there a workaround for CVE-2015-7545?
While updating is the recommended solution for CVE-2015-7545, restricting remote helper protocols may serve as a temporary workaround.