Remote Code Execution (RCE)

2019-01-1509:25:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

git us vulnerable to remote code execution. A remote attacker is able to execute arbitrary code during the processing of a recursive git clone of a superproject, when the .gitmodules file contains a URL field beginning with - character.

CPENameOperatorVersion
giteq1.8.3.1__14.el7_5
giteq1.8.3.1__13.el7
giteq1.7.1__4.el6_7.1
giteq1.8.3.1__19.el7
giteq1.7.1__2.el6
giteq1.7.1__3.el6_4.1
giteq1.7.1__9.el6_9
giteq1.7.1__8.el6
giteq1.7.1__2.el6_0.1
rh-git29-giteq2.9.3__5.el7

Name	Operator	Version
git	eq	1.8.3.1__14.el7_5
git	eq	1.8.3.1__13.el7
git	eq	1.7.1__4.el6_7.1
git	eq	1.8.3.1__19.el7
git	eq	1.7.1__2.el6
git	eq	1.7.1__3.el6_4.1
git	eq	1.7.1__9.el6_9
git	eq	1.7.1__8.el6
git	eq	1.7.1__2.el6_0.1
rh-git29-git	eq	2.9.3__5.el7