NVD Vulnerability Detail

CVE-2017-14867

Summary	Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Publication Date	Sept. 29, 2017, 10:34 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:13 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2017/09/26/9	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2017/09/26/9	Mailing List Third Party Advisory
3	http://www.securityfocus.com/bid/101060	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/101060	Third Party Advisory VDB Entry
5	http://www.securitytracker.com/id/1039431	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id/1039431	Third Party Advisory VDB Entry
7	https://bugs.debian.org/876854	Issue Tracking Mailing List Third Party Advisory
8	https://bugs.debian.org/876854	Issue Tracking Mailing List Third Party Advisory
9	https://lists.debian.org/debian-security-announce/2017/msg00246.html	Mailing List Third Party Advisory
10	https://lists.debian.org/debian-security-announce/2017/msg00246.html	Mailing List Third Party Advisory
11	https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u
12	https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u
13	https://www.debian.org/security/2017/dsa-3984	Third Party Advisory
14	https://www.debian.org/security/2017/dsa-3984	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-78	OSコマンド・インジェクション	https://cwe.mitre.org/data/definitions/78.html

JVN Vulnerability Information

Git における入力確認に関する脆弱性

Title	Git における入力確認に関する脆弱性
Summary	Git には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 26, 2017, midnight
Registration Date	Oct. 25, 2017, 10:37 a.m.
Last Update	Oct. 25, 2017, 10:37 a.m.

Affected System

Debian

Debian GNU/Linux 8.0

Debian GNU/Linux 9.0

Git project

Git 2.10.5 未満

Git 2.11.4 未満の 2.11.x

Git 2.12.5 未満の 2.12.x

Git 2.13.6 未満の 2.13.x

Git 2.14.2 未満の 2.14.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-14867	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14867
National Vulnerability Database (NVD)
2	CVE-2017-14867	https://nvd.nist.gov/vuln/detail/CVE-2017-14867

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian
1	[SECURITY] [DSA 3984-1] git security update	https://lists.debian.org/debian-security-announce/2017/msg00246.html
Debian Bug report logs
2	876854	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876854
Debian Security Advisory
3	DSA-3984	https://www.debian.org/security/2017/dsa-3984
Git
4	Top Page	https://git-scm.com/

その他

No	Name	URL
関連文書
1	Advisory: Git cvsserver OS Command Injection	http://www.openwall.com/lists/oss-security/2017/09/26/9
2	[ANNOUNCE] Git v2.13.6 and others	https://public-inbox.org/git/xmqqy3p29ekj.fsf@gitster.mtv.corp.google.com/T/#u

Change Log

No	Changed Details	Date of change
0	[2017年10月25日] 掲載	Feb. 17, 2018, 10:37 a.m.