CVE-2017-1000117: High severity git-scm Git vulnerability

Q: What is the severity of CVE-2017-1000117?

CVE-2017-1000117 is classified as a high severity vulnerability due to the potential for remote code execution.

Q: How do I fix CVE-2017-1000117?

You can fix CVE-2017-1000117 by upgrading to Git version 2.7.6 or later.

Q: What type of vulnerability is CVE-2017-1000117?

CVE-2017-1000117 is a remote code execution vulnerability.

Q: Which software versions are affected by CVE-2017-1000117?

CVE-2017-1000117 affects Git versions up to and including 2.7.5, and specific versions of 2.8.x and 2.9.x.

Q: Can exploit of CVE-2017-1000117 lead to loss of data?

Yes, the exploitation of CVE-2017-1000117 can potentially lead to data loss if an attacker executes malicious code on the victim's machine.

Published Aug 10, 2017

Updated

A flaw was found in the way the Git client handles "ssh://" URLs. A maliciously crafted "ssh://" URL would cause Git clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious users committing to an honest server (to attack another user of that server's repositories), or by a proxy server.

Other sources

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

— MITRE

Affected Software

59 affected componentsFixes available

redhat/git<2.7.6

2.7.6

redhat/git<2.8.6

2.8.6

redhat/git<2.9.5

2.9.5

redhat/git<2.10.4

2.10.4

redhat/git<2.11.3

2.11.3

redhat/git<2.12.4

2.12.4

redhat/git<2.13.5

2.13.5

redhat/git<2.14.1

2.14.1

git-scm Git<=2.7.5

git-scm Git=2.8.0

git-scm Git=2.8.0-rc0

git-scm Git=2.8.0-rc1

git-scm Git=2.8.0-rc2

git-scm Git=2.8.0-rc3

git-scm Git=2.8.1

git-scm Git=2.8.2

git-scm Git=2.8.3

git-scm Git=2.8.4

git-scm Git=2.8.5

git-scm Git=2.9.0

git-scm Git=2.9.0-rc0

git-scm Git=2.9.0-rc1

git-scm Git=2.9.0-rc2

git-scm Git=2.9.1

git-scm Git=2.9.2

git-scm Git=2.9.3

git-scm Git=2.9.4

git-scm Git=2.10.0

git-scm Git=2.10.0-rc0

git-scm Git=2.10.0-rc1

git-scm Git=2.10.0-rc2

git-scm Git=2.10.1

git-scm Git=2.10.2

git-scm Git=2.10.3

git-scm Git=2.11.0

git-scm Git=2.11.0-rc0

git-scm Git=2.11.0-rc1

git-scm Git=2.11.0-rc2

git-scm Git=2.11.0-rc3

git-scm Git=2.11.1

git-scm Git=2.11.2

git-scm Git=2.12.0

git-scm Git=2.12.0-rc0

git-scm Git=2.12.0-rc1

git-scm Git=2.12.0-rc2

git-scm Git=2.12.1

git-scm Git=2.12.2

git-scm Git=2.12.3

git-scm Git=2.13.0

git-scm Git=2.13.0-rc0

git-scm Git=2.13.0-rc1

git-scm Git=2.13.0-rc2

git-scm Git=2.13.1

git-scm Git=2.13.2

git-scm Git=2.13.3

git-scm Git=2.13.4

git-scm Git=2.14.0

git-scm Git=2.14.0-rc0

git-scm Git=2.14.0-rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.7.6
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.8.6
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.9.5
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.10.4
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.11.3
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.12.4
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.13.5
Upgrade
Upgrade redhat/git to a version that resolves this vulnerability.
Fixed in 2.14.1

Event History

Aug 10, 2017

Data Sourced

via Red Hat·11:54 PM

DescriptionSeverityAffected Software

Oct 4, 2017

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-1000117?

CVE-2017-1000117 is classified as a high severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2017-1000117?