CVE-2017-14867 - CVE House
Back to Database
Status published High CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x...

Vulnerability Description

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14867

Credits & Attribution

No credits recorded in the NVD database.

References

More from git-scm

View All →
CVE-2022-24975
The --mirror documentation for Git through 2.35.1 does not mention...
High 7.5
CVE-2021-40330
git_connect_git in connect.c in Git before 2.30.1 allows a repository...
High 7.5
CVE-2019-19604
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x...
High 7.8
CVE-2018-19486
Git before 2.19.2 on Linux and UNIX executes commands from...
Critical 9.8
CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x...
Critical 9.8

Affected Vendor

Affected Software

git, debian linux
Vulnerable Versions:
0, 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.13.0, 2.13.1, 2.13.2, 2.13.3, 2.13.4, 2.13.5, 2.14.0, 2.14.1, 8.0, 9.0

Timeline

Official Publish: September 28th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.