Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade git | Jan 24, 2023 | Sep 28, 2017 |
| Debian | — | Upgrade git | Dec 5, 2017 | Sep 26, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade git | Nov 30, 2017 | Sep 28, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Nov 30, 2017 | Sep 28, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git-core-docUpgrade git-coreUpgrade git | Nov 19, 2019 | Sep 29, 2017 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.0-0.175.3.28.0.1.0 on Solaris 11.3 | Feb 6, 2018 | Sep 28, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 26, 2017 |
| Suse | — | Upgrade git-archUpgrade gitkUpgrade gitUpgrade git-webUpgrade git-cvsUpgrade git-docUpgrade git-guiUpgrade git-coreUpgrade git-emailUpgrade git-svnUpgrade git-daemon | Oct 2, 2017 | Sep 28, 2017 |
| Ubuntu | — | Upgrade git | Oct 5, 2017 | Sep 28, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 28, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub