Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade git | Jan 24, 2023 | Sep 28, 2017 |
| Debian | — | Upgrade git | Dec 5, 2017 | Sep 26, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade git | Nov 30, 2017 | Sep 28, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Nov 30, 2017 | Sep 28, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git-coreUpgrade gitUpgrade git-core-doc | Nov 19, 2019 | Sep 29, 2017 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.0-0.175.3.28.0.1.0 on Solaris 11.3 | Feb 6, 2018 | Sep 28, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 26, 2017 |
| Suse | — | Upgrade git-docUpgrade git-guiUpgrade git-daemonUpgrade git-coreUpgrade git-svnUpgrade git-emailUpgrade git-cvsUpgrade git-archUpgrade gitkUpgrade git-webUpgrade git | Oct 2, 2017 | Sep 28, 2017 |
| Ubuntu | — | Upgrade git | Oct 5, 2017 | Sep 28, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 28, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub