Security Update for git-annex
Summary
DLA-1144-1: git-annex - security update. Affects git-annex versions < 3.20120629+deb7u1. Fixed in 3.20120629+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-annex is a version control system that manages files with git, without checking the file contents into git. It allows users to store and track large files in a distributed manner. The package is widely used for managing and syncing files across multiple devices and repositories. However, a security vulnerability has been discovered in versions prior to 6.20170818.
Vulnerability Detail
The vulnerability in git-annex allows remote attackers to execute arbitrary commands by exploiting an ssh URL with an initial dash character in the hostname. This can be achieved through an ssh://-eProxyCommand= URL. The vulnerability is similar to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117. If exploited, this vulnerability can lead to unauthorized command execution and potential compromise of the affected system.
How To Fix
Minimum fixed version
3.20120629+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade git-annexTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The vulnerability in git-annex allows remote attackers to execute arbitrary commands, posing a significant security risk. It is crucial to upgrade to the latest version of git-annex to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-annex →
FAQ
git-annex is a version control system that manages files with git, without checking the file contents into git. It allows users to store and track large files in a distributed manner.
The vulnerability allows remote attackers to execute arbitrary commands, potentially leading to unauthorized command execution and compromise of the affected system.
Yes, all versions prior to 6.20170818 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade git-annex to version 6.20170818 or later.
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for git-annex.
