CVE-2015-8968: Command Injection
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8968?
CVE-2015-8968 is considered a high severity vulnerability due to its potential for arbitrary shell command execution.
How do I fix CVE-2015-8968?
To fix CVE-2015-8968, update git-fastclone to version 1.0.1 or later.
What are the consequences of CVE-2015-8968?
The consequences of CVE-2015-8968 include the possibility for attackers to execute arbitrary commands on a user's machine.
Who is affected by CVE-2015-8968?
Users of git-fastclone versions prior to 1.0.1 are affected by CVE-2015-8968.
Can CVE-2015-8968 be exploited remotely?
Yes, CVE-2015-8968 can be exploited remotely if an attacker can convince a user to clone a malicious repository.