Уязвимость CVE-2018-11235: Информация

Описание

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

Важность: HIGH (7,8) Вектор: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-11235
Опубликовано: 30 мая 2018 г.
Изменено: 2 мая 2020 г.
Идентификатор типа ошибки: CWE-22

Исправленные пакеты

Имя пакета
Ветка
Исправлено в версии
Версия в репозитории
Errata ID
№ Задания
Состояние
gitsisyphus2.17.1-alt22.42.2-alt1ALT-PU-2018-2090-1211006Исправлено
gitp102.17.1-alt22.33.8-alt1ALT-PU-2018-2090-1211006Исправлено
gitp92.17.1-alt22.25.4-alt1ALT-PU-2018-2090-1211006Исправлено
gitp82.21.0-alt12.24.1-alt1ALT-PU-2019-1929-1229857Исправлено
gitc10f12.17.1-alt22.42.1-alt1ALT-PU-2018-2090-1211006Исправлено
gitc9f22.17.1-alt22.42.1-alt1ALT-PU-2018-2090-1211006Исправлено
gitp112.17.1-alt22.42.2-alt1ALT-PU-2018-2090-1211006Исправлено
libgit2sisyphus0.26.5-alt11.7.2-alt1ALT-PU-2018-1992-1209737Исправлено
libgit2p100.26.5-alt11.7.2-alt1ALT-PU-2018-1992-1209737Исправлено
libgit2p90.26.5-alt10.28.3-alt1ALT-PU-2018-1992-1209737Исправлено
libgit2c10f10.26.5-alt11.3.2-alt1ALT-PU-2018-1992-1209737Исправлено
libgit2c9f20.26.5-alt10.28.3-alt1ALT-PU-2018-1992-1209737Исправлено
libgit2p110.26.5-alt11.7.2-alt1ALT-PU-2018-1992-1209737Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/
  • Patch
  • Technical Description
  • Vendor Advisory
DSA-4212
  • Third Party Advisory
https://marc.info/?l=git&m=152761328506724&w=2
  • Release Notes
  • Third Party Advisory
1040991
  • Third Party Advisory
  • VDB Entry
104345
  • Third Party Advisory
  • VDB Entry
44822
  • Exploit
  • VDB Entry
  • Third Party Advisory
USN-3671-1
  • Third Party Advisory
RHSA-2018:1957
  • Third Party Advisory
RHSA-2018:2147
  • Third Party Advisory
GLSA-201805-13
  • Third Party Advisory
openSUSE-SU-2020:0598

      1. Конфигурация 1

        cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
        cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

        Конфигурация 2

        cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
        cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
        cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
        cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

        Конфигурация 3

        cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

        Конфигурация 4

        cpe:2.3:a:git-scm:git:2.17.0:*:*:*:*:*:*:*
        cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
        Start including
        2.16.0
        End including
        2.16.3
        cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
        Start including
        2.15.0
        End including
        2.15.1
        cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
        Start including
        2.14.0
        End including
        2.14.3
        cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
        End including
        2.13.6

        Конфигурация 5

        cpe:2.3:a:gitforwindows:git:*:*:*:*:*:*:*:*
        End including
        2.17.1
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Версия: v24.5.3
    Наверх