CVE-2017-14867 describes a critical vulnerability in Git versions prior to 2.10.5, 2.11.4, 2.12.5, 2.13.6, and 2.14.2, affecting Debian Linux and Git-SCM Git. This flaw allows authenticated attackers to execute arbitrary operating system commands by injecting shell metacharacters into module names, leveraging unsafe Perl scripts used for subcommands like cvsserver, even without explicit CVS support. With a CVSSv3 score of 8.8 (High), the vulnerability presents a significant risk due to its network-based attack vector and low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. The EPSS score of 0.06968, while low, indicates it is still more exploitable than a small percentage of all CVEs. Currently, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed in the CISA KEV catalog. Community discussion and media coverage are minimal, suggesting a lack of widespread attention or active exploitation at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.10.4CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
2.11.0CPE matchmatch criteria | cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:* | ||
2.11.1CPE matchmatch criteria | cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:* | ||
2.11.2CPE matchmatch criteria | cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:* | ||
2.11.3CPE matchmatch criteria | cpe:2.3:a:git-scm:git:2.11.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
git: cvsserver command injection
Sep 26, 2017Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
Sep 12, 2017