CVE-2017-17831

Publicada em 21 dez 2017 · Atualizada em 05 ago 2024

Seguir esta CVE + Monitorar github.com/git-lfs/git-lfs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.7%

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Produtos afetados

n/a · n/a

Referências

http://blog.recurity-labs.com/2017-08-10/scm-vulns https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html https://github.com/git-lfs/git-lfs/pull/2242 https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1 http://www.securityfocus.com/bid/102926