Summary
It was discovered that Git incorrectly handled certain subcommands such as
cvsserver. A remote attacker could possibly use this issue via shell
metacharacters in modules names to execute arbitrary code.
This update also removes the cvsserver subcommand from git-shell by
default.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | git | 1:1.9.1-1ubuntu0.7 |
| Ubuntu · 16.04 LTS 16.04:LTS | git | 1:2.7.4-0ubuntu1.3 |
Vulnerabilities 1
-
Unscored —CVE-2017-14867 EPSS 36%
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsa…
References
-
report
https://ubuntu.com/security/CVE-2017-14867