Git - Arbitrary Shell Command Execution via Malicious SSH URLs
Summary
DLA-1068-1: git - security update. Affects git versions < 1:1.7.10.4-1+wheezy5. Fixed in 1:1.7.10.4-1+wheezy5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system commonly used for source code management. It allows multiple developers to collaborate on a project by tracking changes to files and coordinating their work. Git supports various protocols for remote access, including SSH. This vulnerability affects the Debian 7 (Wheezy) version of Git.
Vulnerability Detail
The vulnerability in Git arises from its mishandling of maliciously constructed SSH URLs. An attacker can exploit this flaw by crafting a specially crafted SSH URL, which can be triggered when performing operations like cloning or updating repositories. This allows the attacker to execute arbitrary shell commands on the target system, potentially leading to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Minimum fixed version
1:1.7.10.4-1+wheezy5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading the Git package to the patched version.
Conclusion
In conclusion, the Git vulnerability allows for the execution of arbitrary shell commands through malicious SSH URLs. To mitigate this risk, it is recommended to upgrade the Git package to the patched version. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is a distributed revision control system used for tracking changes in files and coordinating work among multiple developers.
This vulnerability allows an attacker to execute arbitrary shell commands on a target system by exploiting the mishandling of malicious SSH URLs in Git.
The consequences of this vulnerability can include unauthorized access, data manipulation, and other malicious activities on the affected system.
To fix this vulnerability, you should upgrade the Git package to version 1.7.10.4-1+wheezy5 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided fix by upgrading the Git package.
Related vulnerabilities
Recent vulnerabilities recorded for git.
