CVE-2017-14867 Command injection in n/a
Attackers can execute arbitrary OS commands via shell metacharacters in module names using unsafe Perl scripts in Git.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-14867?
CVE-2017-14867 is a high-severity command injection vulnerability in Debian Debian Linux, published on 28 Sep 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Weakness: CWE-78
Which versions are affected by CVE-2017-14867?
It affects 2 products.
Linux distribution packages (12)
git SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Server 12 SP2 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Server 12 SP3 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 1.7.12.4-0.18.6.1 |
git SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 2.12.3-27.9.1 |
git SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 2.12.3-27.9.1 |
git SUSE:OpenStack Cloud 6 | All versions | 2.12.3-27.9.1 |
git SUSE:Studio Onsite 1.3 | All versions | 1.7.12.4-0.18.6.1 |
Products include Debian Debian Linux, Git-Scm Git.
How do I fix CVE-2017-14867?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-14867 being exploited?
There is no known exploitation of CVE-2017-14867 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-43047, DEBIAN-CVE-2017-14867, DLA-1120-1, DSA-3984-1, GHSA-h66v-9g4g-85x5, MGASA-2017-0404 and 4 more.