7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.17 Low
EPSS
Percentile
96.1%
Upstream security update resolving an issue with git clone --recurse-submodules
.
From the [upstream release announcement](https://public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct .c.googlers.com/) :
> These releases fix a security flaw (CVE-2018-17456), which allowed an > attacker to execute arbitrary code by crafting a malicious .gitmodules > file in a project cloned with --recurse-submodules. > > When running ‘git clone --recurse-submodules’, Git parses the supplied > .gitmodules file for a URL field and blindly passes it as an argument > to a ‘git clone’ subprocess. If the URL field is set to a string that > begins with a dash, this ‘git clone’ subprocess interprets the URL as > an option. This can lead to executing an arbitrary script shipped in > the superproject as the user who ran ‘git clone’. > > In addition to fixing the security issue for the user running ‘clone’, > the 2.17.2, 2.18.1 and 2.19.1 releases have an ‘fsck’ check which can > be used to detect such malicious repository content when fetching or > accepting a push. See ‘transfer.fsckObjects’ in git-config(1). > > Credit for finding and fixing this vulnerability goes to joernchen > and Jeff King, respectively.
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2018-d5139c4fd6.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(118244);
script_version("1.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/06");
script_cve_id("CVE-2018-17456");
script_xref(name:"FEDORA", value:"2018-d5139c4fd6");
script_name(english:"Fedora 27 : git (2018-d5139c4fd6)");
script_summary(english:"Checks rpm output for the updated package.");
script_set_attribute(
attribute:"synopsis",
value:"The remote Fedora host is missing a security update."
);
script_set_attribute(
attribute:"description",
value:
"Upstream security update resolving an issue with `git clone
--recurse-submodules`.
From the [upstream release
announcement](https://public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct
.c.googlers.com/) :
> These releases fix a security flaw (CVE-2018-17456), which allowed
an > attacker to execute arbitrary code by crafting a malicious
.gitmodules > file in a project cloned with --recurse-submodules. > >
When running 'git clone --recurse-submodules', Git parses the supplied
> .gitmodules file for a URL field and blindly passes it as an
argument > to a 'git clone' subprocess. If the URL field is set to a
string that > begins with a dash, this 'git clone' subprocess
interprets the URL as > an option. This can lead to executing an
arbitrary script shipped in > the superproject as the user who ran
'git clone'. > > In addition to fixing the security issue for the user
running 'clone', > the 2.17.2, 2.18.1 and 2.19.1 releases have an
'fsck' check which can > be used to detect such malicious repository
content when fetching or > accepting a push. See
'transfer.fsckObjects' in git-config(1). > > Credit for finding and
fixing this vulnerability goes to joernchen > and Jeff King,
respectively.
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5139c4fd6"
);
script_set_attribute(attribute:"solution", value:"Update the affected git package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Malicious Git HTTP Server For CVE-2018-17456');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:git");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:27");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/06");
script_set_attribute(attribute:"patch_publication_date", value:"2018/10/19");
script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/22");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Fedora Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^27([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 27", "Fedora " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
flag = 0;
if (rpm_check(release:"FC27", reference:"git-2.14.5-1.fc27")) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "git");
}
Vendor | Product | Version | CPE |
---|---|---|---|
fedoraproject | fedora | git | p-cpe:/a:fedoraproject:fedora:git |
fedoraproject | fedora | 27 | cpe:/o:fedoraproject:fedora:27 |
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.17 Low
EPSS
Percentile
96.1%