A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-git | Aug 22, 2024 | Oct 4, 2017 | |
| Amazon_linux | — | amazon-linux-upgrade-git | Dec 20, 2017 | Aug 31, 2017 |
| Centos_linux | — | centos-upgrade-emacs-gitcentos-upgrade-emacs-git-elcentos-upgrade-gitcentos-upgrade-git-allcentos-upgrade-git-bzrcentos-upgrade-git-cvscentos-upgrade-git-daemoncentos-upgrade-git-debuginfocentos-upgrade-git-emailcentos-upgrade-git-guicentos-upgrade-git-hgcentos-upgrade-git-p4centos-upgrade-git-svncentos-upgrade-gitkcentos-upgrade-gitwebcentos-upgrade-perl-gitcentos-upgrade-perl-git-svn | Aug 28, 2019 | Oct 5, 2017 |
| Redhat_linux | — | redhat-upgrade-emacs-gitredhat-upgrade-emacs-git-elredhat-upgrade-gitredhat-upgrade-git-allredhat-upgrade-git-bzrredhat-upgrade-git-cvsredhat-upgrade-git-daemonredhat-upgrade-git-debuginforedhat-upgrade-git-emailredhat-upgrade-git-guiredhat-upgrade-git-hgredhat-upgrade-git-p4redhat-upgrade-git-svnredhat-upgrade-gitkredhat-upgrade-gitwebredhat-upgrade-perl-gitredhat-upgrade-perl-git-svn | Jan 17, 2018 | Aug 16, 2017 |
| Suse | — | suse-upgrade-gitsuse-upgrade-git-archsuse-upgrade-git-coresuse-upgrade-git-cvssuse-upgrade-git-daemonsuse-upgrade-git-docsuse-upgrade-git-emailsuse-upgrade-git-guisuse-upgrade-git-svnsuse-upgrade-git-websuse-upgrade-gitk | Jan 26, 2018 | Aug 21, 2017 |
| Ubuntu | ubuntu-upgrade-git | Dec 20, 2017 | Aug 11, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub