Amazon Linux AMI : git (ALAS-2017-910)

The 'git' subcommand 'cvsserver' is a Perl script which makes excessive use of the backtick operator to invoke 'git'. Unfortunately user input is used within some of those invocations. It should be noted, that 'git-cvsserver' will be invoked by 'git-shell' by default without further configuration...