Description
The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | git-core | 1:1.4.4.4-4+etch1 | DSA-1708-1 |
Advisories 1
- DSA-1708-1 git-core - remote code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1708 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=479715
- GLSA-200903-15 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0005
- ADV-2009-0175 vdb-entry
- http://repo.or.cz/w/git.git?a=commitdiff%3Bh=c582abae
- 4919 third-party-advisory
- 34194 third-party-advisory
- 33964 third-party-advisory
- SUSE-SR:2009:001 vendor-advisory
- [oss-security] 20090123 Re: CVE request -- git mailing-list
- 20090113 rPSA-2009-0005-1 git gitweb mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330
- [oss-security] 20090120 Re: CVE request -- git mailing-list
- [oss-security] 20090121 Re: CVE request -- git mailing-list
- https://issues.rpath.com/browse/RPL-2936
- USN-723-1 vendor-advisory