631 matches found
UBUNTU-CVE-2019-1387
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote cod...
CVE-2019-19604: Improper Neutralization of Special Elements used in an OS Command
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository...
PT-2019-5022
Name of the Vulnerable Software and Affected Versions Git versions prior to 2.24.1 Git versions prior to 2.23.1 Git versions prior to 2.22.2 Git versions prior to 2.21.1 Git versions prior to 2.20.2 Git versions prior to 2.19.3 Git versions prior to 2.18.2 Git versions prior to 2.17.3 Git version...
PT-2019-4871
Name of the Vulnerable Software and Affected Versions Git versions prior to 2.20.2 Git versions 2.21.x prior to 2.21.1 Git versions 2.22.x prior to 2.22.2 Git versions 2.23.x prior to 2.23.1 Git versions 2.24.x prior to 2.24.1 Description The issue allows for arbitrary command execution because a...
PT-2019-5025
Name of the Vulnerable Software and Affected Versions Git affected versions not specified Description The vulnerability in the recursive submodule cloning component of the distributed version control system Git is related to an insufficient input validation mechanism. Exploitation of this issue m...
DRUPAL-CONTRIB-2019-068
This module enables you to control access to content based on taxonomy terms. The module doesn't sufficiently check if a given entity should be access controlled, defaulting to allowing access even to unpublished nodes. The vulnerability is mitigated by the fact that the submodule Permissions by...
NewStart CGSL CORE 5.04 / MAIN 5.04 : git Vulnerability (NS-SA-2019-0027)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has git packages installed that are affected by a vulnerability: - In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafte...
Atlassian SourceTree 1.2 < 3.1.1 Multiple remote code execution vulnerabilities
The version of Atlassian SourceTree installed on the remote Windows host is version 1.2 prior to 3.1.1. It is, therefore, affected by multiple remote code execution vulnerabilities. - An option injection vulnerability exists in the git submodule component. An unauthenticated, remote attacker can...
Security update for obs-service-tar_scm (important)
openSUSE Security Update: Security update for obs-service-tarscm Announcement ID: openSUSE-SU-2019:0329-1 Rating: important References: 1076410 1082696 1105361 1107507 1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Backports SLE-15 An update tha...
Atlassian SourceTree 0.5a < 3.0.17 Multiple remote code execution vulnerabilities
The version of Atlassian SourceTree installed on the remote Windows host is version 0.5a prior to 3.0.17. It is, therefore, affected by multiple remote code execution vulnerabilities. - An option injection vulnerability exists in the git submodule component. An unauthenticated, remote attacker ca...
openSUSE: Security Advisory for obs-service-tar_scm (openSUSE-SU-2019:0326-1)
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Git Submodule Code Execution
The vulnerability of the distributed Git version control system is related to errors in the processing of specially crafted module names in the .gitmodules file. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
openSUSE Security Update : libgit2 (openSUSE-2018-1517)
This update for libgit2 fixes the following issues : Security issue fixed : - CVE-2018-17456: Submodule URLs and paths with a leading '-' are now ignored to avoid injecting options into library consumers that perform recursive clones bsc1110949. Non-security issues fixed : - Version update to...
Git Submodule Arbitrary Code Execution
CVE-2018-17456 I've gotten a couple of questions about exploitation for the recent RCE in Git. So here we go with some technical details. TL;DR Here is a PoC repository. EDB Note: Mirror https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45631.zip Exploitation The...
Git Submodule - Arbitrary Code Execution
Git Submodule - Arbitrary Code Execution CVE-2018-17456 I've gotten a couple of questions about exploitation for the recent RCE in Git. So here we go with some technical details. TL;DR Here is a PoC repository. EDB Note: Mirror...
Git Submodule - Arbitrary Code Execution
CVE-2018-17456 I've gotten a couple of questions about exploitation for the recent RCE in Git. So here we go with some technical details. TL;DR Here is a PoC repository. EDB Note: Mirror https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45631.zip Exploitation The...
MGASA-2018-0395 Updated git packages fix security vulnerability
joernchen of Phenoelit discovered that git is prone to an arbitrary code execution vulnerability due to insufficient validation of submodule url and path via a specially crafted .gitmodules file in a project cloned with --recurse-submodules CVE-2018-17456...
Updated git packages fix security vulnerability
joernchen of Phenoelit discovered that git is prone to an arbitrary code execution vulnerability due to insufficient validation of submodule url and path via a specially crafted .gitmodules file in a project cloned with --recurse-submodules CVE-2018-17456...
USN-3791-1 git vulnerability
It was discovered that git did not properly validate git submodule urls or paths. A remote attacker could possibly use this to craft a git repository that causes arbitrary code execution when recursive operations are used...
USN-3791-1: Git vulnerability
It was discovered that git did not properly validate git submodule urls or paths. A remote attacker could possibly use this to craft a git repository that causes arbitrary code execution when recursive operations are used...