Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade git | Jan 24, 2023 | Sep 28, 2017 |
| Debian | — | Upgrade git | Dec 5, 2017 | Sep 26, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade git | Nov 30, 2017 | Sep 28, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Nov 30, 2017 | Sep 28, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade gitUpgrade git-coreUpgrade git-core-doc | Nov 19, 2019 | Sep 29, 2017 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.0-0.175.3.28.0.1.0 on Solaris 11.3 | Feb 6, 2018 | Sep 28, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 26, 2017 |
| Suse | — | Upgrade git-archUpgrade git-webUpgrade gitUpgrade gitkUpgrade git-docUpgrade git-svnUpgrade git-guiUpgrade git-emailUpgrade git-coreUpgrade git-daemonUpgrade git-cvs | Oct 2, 2017 | Sep 28, 2017 |
| Ubuntu | — | Upgrade git | Oct 5, 2017 | Sep 28, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 28, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub