Improper Input Validation Affecting git package, versions <1:2.6.1-1
Snyk CVSS
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN9-GIT-340845
- published 13 Apr 2016
- disclosed 13 Apr 2016
How to fix?
Upgrade Debian:9
git
to version 1:2.6.1-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream git
package and not the git
package as distributed by Debian:9
.
See How to fix?
for Debian:9
relevant fixed versions and status.
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
References
- ADVISORY
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- Debian Security Advisory
- Gentoo Security Advisory
- MLIST
- OpenSuse Security Update
- Oracle Security Bulletin
- Oracle Security Bulletin
- Oracle Security Bulletin
- OSS security Advisory
- OSS security Advisory
- OSS security Advisory
- RedHat Bugzilla Bug
- RedHat Security Advisory
- Security Focus
- Security Tracker
- SLACKWARE
- Ubuntu CVE Tracker
- Ubuntu Security Advisory