CVE-2017-17831
high
CVSS v3
8.8
CVSS v2
6.8
VIR risk
8.8
Description
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-17831
Vendor advisory: cve@mitre.org — https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1
Vendor advisory: cve@mitre.org — https://github.com/git-lfs/git-lfs/pull/2242
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 0 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/git-lfs/git-lfs | <2.1.1-0.20170519163204-f913f5f9c7c6 | 2.1.1-0.20170519163204-f913f5f9c7c6 |
| Go | github.com/git-lfs/git-lfs | <2.1.1-0.20170519163204-f913f5f9c7c6+incompatible | 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| git_large_file_storage_project | git_large_file_storage | {"endExcluding":"2.1.1"} | 2.1.1 |
References
- http://blog.recurity-labs.com/2017-08-10/scm-vulns
- http://www.securityfocus.com/bid/102926
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
- https://github.com/git-lfs/git-lfs/pull/2242
- https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1
- https://nvd.nist.gov/vuln/detail/CVE-2017-17831
- https://github.com/git-lfs/git-lfs/pull/2241
- https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19
- https://github.com/git-lfs/git-lfs
- https://pkg.go.dev/vuln/GO-2021-0073
- https://web.archive.org/web/20200227131639/http://www.securityfocus.com/bid/102926
- https://security-tracker.debian.org/tracker/CVE-2017-17831
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.