748 matches found
CVE-2017-17831
CVE-2017-17831 affects GitHub Git LFS prior to 2.1.1. A remote attacker can trigger arbitrary command execution by supplying an SSH URL whose hostname starts with the dash character, as parsed from a url = line in a repository’s .lfsconfig. This corresponds to a high-severity impact (CVSS v3.0: 8...
CVE-2017-17831
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository...
Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831
The embedded version of Git LFS|https://git-lfs.github.com used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing...
Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831
The embedded version of Git LFS|https://git-lfs.github.com used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing...
PT-2017-15036
Name of the Vulnerable Software and Affected Versions Git LFS versions prior to 2.1.1 Description The issue allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a url = line in a .lfsconfig file within a repository. This c...
CVE-2017-17831: Improper Input Validation
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository...