Description
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | git | 1:2.14.1-1 | — |
| Debian 13 | git | 1:2.14.1-1 | — |
| Debian 12 | git | 1:2.14.1-1 | — |
| Debian 9 | git | 1:2.11.0-3+deb9u1 | DSA-3934-1 |
| Debian 8 | git | 1:2.1.4-2.1+deb8u4 | DSA-3934-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | git | 1:1.7.10.4-1+wheezy5 | DLA-1068-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | git | 1:2.7.4-0ubuntu1.2 | USN-3387-1 |
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.6 | USN-3387-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | git +15 | 1.8.3.1-12.el7_4 | RHSA-2017:2484 |
| RHEL 6 | git +11 | 1.7.1-9.el6_9 | RHSA-2017:2485 |
| RHEL 2 | rh-git29-git +15 | 2.9.3-3.el6 | RHSA-2017:2491 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Mobile Application Platform 4 | fh-system-dump-tool | 1.0.0-5.el7 | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | fping | 3.10-4.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | nagios +2 | 4.0.8-8.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | nagios-plugins +55 | 2.0.3-3.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | perl-Crypt-CBC | 2.33-2.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | perl-Crypt-DES | 2.05-20.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | perl-Net-SNMP | 6.0.1-7.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | phantomjs | 1.9.7-3.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | python-meld3 | 0.6.10-1.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | qstat | 2.11-13.20080912svn311.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | radiusclient-ng +2 | 0.5.6-9.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | redis | 2.8.21-2.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | rhmap-fh-openshift-templates | 4.5.0-11.el7 | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | rhmap-mod_authnz_external | 3.3.1-7.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | sendEmail | 1.56-2.el7 | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | ssmtp | 2.64-14.el7map | RHSA-2017:2674 |
| Red Hat Mobile Application Platform 4 | supervisor | 3.1.3-3.el7map | RHSA-2017:2674 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES 12 SP2 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES 12 SP1 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES 12 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES 11 SP4 | git | 1.7.12.4-0.18.3.1 | SUSE-SU-2017:2225-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Studio Onsite 1.3 | git | 1.7.12.4-0.18.3.1 | SUSE-SU-2017:2225-1 |
| SLES for SAP 12 SP3 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES for SAP 12 SP2 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES for SAP 12 SP1 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SLES for SAP 12 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
| SUSE OpenStack Cloud 6 | git | 2.12.3-27.5.1 | SUSE-SU-2017:2320-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.33.0-1.3 | openSUSE-SU-2024:10786-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | git | 2.14.1-r0 | — |
| Alpine v3.23 | git | 2.14.1-r0 | — |
| Alpine v3.22 | git | 2.14.1-r0 | — |
| Alpine v3.21 | git | 2.14.1-r0 | — |
| Alpine v3.20 | git | 2.14.1-r0 | — |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | git | 2.14.1-r0 | — |
| Alpine v3.18 | git | 2.14.1-r0 | — |
| Alpine v3.17 | git | 2.14.1-r0 | — |
| Alpine v3.16 | git | 2.14.1-r0 | — |
| Alpine v3.15 | git | 2.14.1-r0 | — |
| Alpine v3.14 | git | 2.14.1-r0 | — |
| Alpine v3.13 | git | 2.14.1-r0 | — |
| Alpine v3.12 | git | 2.14.1-r0 | — |
| Alpine v3.11 | git | 2.14.1-r0 | — |
| Alpine v3.10 | git | 2.14.1-r0 | — |
| Alpine v3.9 | git | 2.14.1-r0 | — |
| Alpine v3.8 | git | 2.14.1-r0 | — |
| Alpine v3.7 | git | 2.14.1-r0 | — |
| Alpine v3.6 | git | 2.13.5 | — |
| Alpine v3.5 | git | 2.11.3-r0 | — |
| Alpine v3.4 | git | 2.8.6 | — |
| Alpine v3.3 | git | 2.8.6-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | git +15 | 1.8.3.1-12.el7_4 | ELSA-2017-2484 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Malicious Git HTTP Server For CVE-2017-1000117
exploit/multi/http/git_submodule_command_exec
Exploit-DB 1
- Git < 2.7.5 - Command Injection (Metasploit) EDB-42599 · remote · Aug 31, 2017 · verified
GitHub 22 repositories · most starred shown
-
greymd/CVE-2017-1000117 ★ 136 · Aug 14, 2017
Check Git's vulnerability CVE-2017-1000117
-
Manouchehri/CVE-2017-1000117 ★ 15 · Aug 11, 2017
-
timwr/CVE-2017-1000117 ★ 7 · Aug 11, 2017
Proof of concept of CVE-2017-1000117
-
ieee0824/CVE-2017-1000117 ★ 4 · Aug 16, 2017
-
AnonymKing/CVE-2017-1000117 ★ 3 · Jun 20, 2019
CVE-2017-1000117漏洞复现（PoC+Exp）
-
VulApps/CVE-2017-1000117 ★ 3 · Aug 12, 2017
-
nkoneko/CVE-2017-1000117 ★ 2 · Aug 18, 2017
GitのCommand Injectionの脆弱性を利用してスクリプトを落として実行する例
-
leezp/CVE-2017-1000117 ★ 1 · May 20, 2019
-
sasairc/CVE-2017-1000117_wasawasa ★ 1 · Aug 15, 2017
-
thelastbyte/CVE-2017-1000117 ★ 0 · Aug 12, 2017
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 11
- RHSA-2017:2674 Red Hat Security Advisory: Red Hat Mobile Application Platform security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2491 Red Hat Security Advisory: rh-git29-git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2484 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2485 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-3934-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1068-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3387-1 git vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10786-1 git-2.33.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2225-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2320-1 Security update for git SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2017-2484 Important: git security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 16, 2017
References
- DSA-3934 vendor-advisory
- RHSA-2017:2674 vendor-advisory
- 1039131 vdb-entry
- 42599 exploit
- RHSA-2017:2675 vendor-advisory
- RHSA-2017:2484 vendor-advisory
- RHSA-2017:2491 vendor-advisory
- https://support.apple.com/HT208103
- https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html
- 100283 vdb-entry
- GLSA-201709-10 vendor-advisory
- RHSA-2017:2485 vendor-advisory