Debian Security Advisory
DSA-3934-1 git -- security update
- Date Reported:
- 10 Aug 2017
- Affected Packages:
- git
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2017-1000117.
- More information:
-
Joern Schneeweisz discovered that git, a distributed revision control system, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via git submodules.
For the oldstable distribution (jessie), this problem has been fixed in version 1:2.1.4-2.1+deb8u4.
For the stable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u1.
We recommend that you upgrade your git packages.