GitHub Git LFS Arbitrary command execution vulnerability
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a `url =` line in a `.lfsconfig` file within a repository. ### Specific Go Packages Affected github.com/git-lfs/git-lfs/lfsapi
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-17831US | high8.8 | — | ||
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfs… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://blog.recurity-labs.com/2017-08-10/scm-vulnsWEB
- http://www.securityfocus.com/bid/102926WEB
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlWEB
- https://github.com/git-lfs/git-lfsPACKAGE
- https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19WEB
- https://github.com/git-lfs/git-lfs/pull/2241WEB
- https://github.com/git-lfs/git-lfs/pull/2242WEB
- https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan