CVE-2017-14867: OS Command Injection
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14867?
CVE-2017-14867 has a high severity rating due to the potential for arbitrary OS command execution.
How do I fix CVE-2017-14867?
To fix CVE-2017-14867, upgrade Git to version 2.10.5 or later.
What versions of Git are affected by CVE-2017-14867?
CVE-2017-14867 affects Git versions before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2.
Can CVE-2017-14867 be exploited remotely?
Yes, CVE-2017-14867 can potentially be exploited remotely if an attacker has access to input the module name.
What should I do if I'm using an affected version of Git and cannot upgrade immediately for CVE-2017-14867?
If you cannot upgrade immediately, limit the use of vulnerable subcommands and monitor logs for unusual activity as a temporary measure.