Git - Security Update (DLA-938-1)
Summary
DLA-938-1: git - security update. Affects git versions < 1:1.7.10.4-1+wheezy4. Fixed in 1:1.7.10.4-1+wheezy4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed version control system that allows multiple developers to collaborate on a project. It provides a way to track changes in files and manage different versions of the code. The git-shell is a restricted login shell that allows users to access Git repositories via SSH. It provides limited functionality to ensure security and prevent unauthorized access.
Vulnerability Detail
The Git git-shell in Debian 7 Wheezy is vulnerable to an issue where a user can run an interactive pager by causing it to spawn "git upload-pack --help". This vulnerability can be exploited by an attacker with Git-only SSH access to execute arbitrary commands or access unauthorized information. The issue could potentially lead to remote code execution or unauthorized data access.
How To Fix
Minimum fixed version
1:1.7.10.4-1+wheezy4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have Git-only SSH access and by monitoring for any suspicious activity or unauthorized access to Git repositories.
Conclusion
The Git git-shell vulnerability in Debian 7 Wheezy allows users with Git-only SSH access to run an interactive pager and potentially execute arbitrary commands or access unauthorized information. It is crucial to upgrade the git package to the fixed version to mitigate the risk of remote code execution and unauthorized data access. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for git →
FAQ
Git git-shell is a restricted login shell that provides limited functionality for Git-only SSH access. It is designed to prevent unauthorized access and ensure security.
This vulnerability can be exploited by a user with Git-only SSH access by causing the git-shell to spawn "git upload-pack --help", which allows them to run an interactive pager and potentially execute arbitrary commands or access unauthorized information.
The potential consequences of this vulnerability include remote code execution, unauthorized access to sensitive information, and potential compromise of the Git repositories.
Yes, this vulnerability has been fixed in git version 1:1.7.10.4-1+wheezy4 or later. It is recommended to upgrade to the latest version to ensure the security of the system.
To upgrade the git package, you can use the package manager or manually download and install the updated version from the official Debian repository.
Related vulnerabilities
Recent vulnerabilities recorded for git.
