CVE-2015-7545

EPSS 20.1%

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Produtos afetados

n/a · n/a

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html http://rhn.redhat.com/errata/RHSA-2015-2515.html https://bugzilla.redhat.com/show_bug.cgi?id=1269794 https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021 https://lkml.org/lkml/2015/10/5/683 https://security.gentoo.org/glsa/201605-01 http://www.debian.org/security/2016/dsa-3435 http://www.openwall.com/lists/oss-security/2015/12/08/5