Agent-to-controller security bypass in Debian Package Builder

Debian Package Builder 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller. This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller. As of publication of...