Skip to content
OpenAdvisories
Unscored USN-3387-1 1 CVE

git vulnerability

Published Aug 11, 2017 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did
not properly handle host names in 'ssh://' URLs. A remote attacker
could use this to construct a git repository that when accessed could
run arbitrary code with the privileges of the user.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS git 1:1.9.1-1ubuntu0.6
Ubuntu · 16.04 LTS 16.04:LTS git 1:2.7.4-0ubuntu1.2

Vulnerabilities 1

  • Unscored —
    CVE-2017-1000117 Public exploit EPSS 78%

    A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL c…

    git git git Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2017-1000117