CVE-2008-5516 Command injection in n/a

What is CVE-2008-5516?

CVE-2008-5516 is a high-severity command injection vulnerability in n/a, published on 20 Jan 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.

Weakness: CWE-78, CWE-264

Which versions are affected by CVE-2008-5516?

It affects 2 products.

Products include Git-Scm Git, Git Git.

How do I fix CVE-2008-5516?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2008-5516 being exploited?

There is no known exploitation of CVE-2008-5516 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-23521 gitattributes parsing integer overflow in git Critical 9.8
• CVE-2022-41903 Integer overflow in `git archive`, `git log --format` leading to RCE in git Critical 9.8
• CVE-2019-1353 Security feature bypass in Git Critical 9.8
• CVE-2016-2315 Memory corruption in n/a Critical 9.8
• CVE-2016-2324 Integer overflow in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-932q-24j4-3r46.