NetSight
IP …
critical9.8Public exploit code

CVE-2018-17456

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code executio…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

Affected products

VendorProductAffected versions
Git-ScmGit
from 2.14.0 before 2.14.5
from 2.15.0 before 2.15.3
from 2.16.0 before 2.16.5
from 2.17.0 before 2.17.2
from 2.18.0 before 2.18.1
from 2.19.0 before 2.19.1
RedhatAnsible Tower
Version 3.3
RedhatEnterprise Linux
Versions 6.0, 6.7, 7.0, 7.3, 7.4, 7.5
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Version 7.6
RedhatEnterprise Linux Server Eus
Version 7.6
RedhatEnterprise Linux Server Tus
Version 7.6
RedhatEnterprise Linux Workstation
Version 7.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04
DebianDebian Linux
Version 9.0

Weakness classification

CWE-88

References