CVE-2017-8386 Command injection in n/a
Authenticated users can gain privileges or execute code via repository names starting with a dash in git-shell.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-8386?
CVE-2017-8386 is a high-severity command injection vulnerability in Canonical Ubuntu Linux, published on 1 Jun 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.
Which versions are affected by CVE-2017-8386?
It affects 5 products.
Linux distribution packages (9)
git SUSE:Linux Enterprise Server 12 SP1 | All versions | 2.12.3-26.1 |
git SUSE:Linux Enterprise Server 12 SP2 | All versions | 2.12.3-26.1 |
git SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 2.12.3-26.1 |
git SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 2.12.3-26.1 |
git SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 2.12.3-26.1 |
git SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 1.7.12.4-0.17.1 |
git SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 2.12.3-26.1 |
git SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 2.12.3-26.1 |
git SUSE:Studio Onsite 1.3 | All versions | 1.7.12.4-0.17.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Git Git-Shell, Opensuse Leap.
How do I fix CVE-2017-8386?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-8386 being exploited?
There is no known exploitation of CVE-2017-8386 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2017-8386, DEBIAN-CVE-2017-8386, DLA-938-1, DSA-3848-1, GHSA-xqh5-ghjx-6xv5, MGASA-2017-0153 and 4 more.