CVE-2017-14867
Fixed in a distro release EPSS 36%
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Products: git-scm git, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | git | 1:2.14.2-1 |
| Debian 13 | git | 1:2.14.2-1 |
| Debian 14 | git | 1:2.14.2-1 |
| Debian 7 | git | 1:1.7.10.4-1+wheezy6 |
| Debian 8 | git | 1:2.1.4-2.1+deb8u5 |
| Debian 9 | git | 1:2.11.0-3+deb9u2 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Server 12 SP2 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Server 12 SP3 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | git | 1.7.12.4-0.18.6.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | git | 2.12.3-27.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | git | 2.12.3-27.9.1 |
| SUSE Linux Micro 6.0 | git | 2.45.1-1.1 |
| SUSE OpenStack Cloud 6 | git | 2.12.3-27.9.1 |
| SUSE Studio Onsite 1.3 | git | 1.7.12.4-0.18.6.1 |
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.7 |
| Ubuntu 16.04 LTS | git | 1:2.7.4-0ubuntu1.3 |
| openSUSE Tumbleweed | git | 2.33.0-1.3 |