CVE-2015-7545 — Improper Input Validation in Project GIT

CWE-20 — Improper Input ValidationCWE-284 — Improper Access ControlCWE-77 — Command Injection14 documents9 sources
Severity
9.8CRITICALNVD
EPSS
34.7%
top 2.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
GITGIT Project GITCanonical Ubuntu Linux+2 more
Timeline
PublishedApr 13
Latest updateMay 14

Description

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶Debiangit/git< 1:2.6.1-1+3
▶NVDgit_project/git2.3.9+15
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Ubuntu Linux 12.04, 14.04, 15.04, 15.10

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-3rvg-chjx-7h2j: The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2↗2022-05-14
▶
OSV
CVE-2015-7545: The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2↗2016-04-13
▶
CVEList
CVE-2015-7545: The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2↗2016-04-13
▶

📋Vendor Advisories

3
Ubuntu
Git vulnerability↗2015-12-15
▶
Red Hat
git: arbitrary code execution via crafted URLs↗2015-10-05
▶
Debian
CVE-2015-7545: git - The (1) git-remote-ext and (2) unspecified other remote helper programs in Git b...↗2015
▶

💬Community

7
Bugzilla
CVE-2016-3105 mercurial: arbitrary code execution when converting git repos↗2016-05-04
▶
Bugzilla
mercurial: arbitrary code execution with Git subrepos↗2016-03-30
▶
Bugzilla
CVE-2016-3068 mercurial: command injection via git subrepository urls↗2016-03-21
▶
HackerOne
git-fastclone allows arbitrary command execution through usage of ext remote URLs in submodules↗2016-01-25
▶
Bugzilla
CVE-2015-7545 git: arbitrary code execution via crafted URLs [epel-5]↗2015-10-08
▶
CVE-2015-7545 — Improper Input Validation | cvebase