CVE-2017-8386: High severity git shell vulnerability
A vulnerability was found in git concerning the git shell. A user who comes over SSH could run an interactive pager by causing it to spawn "git upload-pack --help".
"git-shell" is a restricted login shell that can be used on a server to prevent SSH clients from running any programs except those needed for git fetches and pushes. If you are not running a server, or if your server has not been explicitly configured to use git-shell as a login shell, you are not affected.
Upstream patch:
https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5
References:
https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ http://public-inbox.org/git/xmqq8tm5ziat.fsf@gitster.mtv.corp.google.com/
Other sources
git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8386?
CVE-2017-8386 has been classified as a medium-level vulnerability that can allow remote authenticated users to gain elevated privileges.
How do I fix CVE-2017-8386?
To fix CVE-2017-8386, update your git installation to a version greater than or equal to the latest patched version, based on your distribution.
Which versions of git are affected by CVE-2017-8386?
CVE-2017-8386 affects git versions before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, and several other versions before their respective patched releases.
What systems are impacted by CVE-2017-8386?
CVE-2017-8386 can impact systems running affected versions of git across various distributions, including Debian, Ubuntu, and Fedora.
Can CVE-2017-8386 be exploited remotely?
Yes, CVE-2017-8386 can be exploited by remote authenticated users through specific repository names.