A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
{
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "2.7.5"
},
{
"last_affected": "2.8.0"
},
{
"last_affected": "2.8.0-rc0"
},
{
"last_affected": "2.8.0-rc1"
},
{
"last_affected": "2.8.0-rc2"
},
{
"last_affected": "2.8.0-rc3"
},
{
"last_affected": "2.8.1"
},
{
"last_affected": "2.8.2"
},
{
"last_affected": "2.8.3"
},
{
"last_affected": "2.8.4"
},
{
"last_affected": "2.8.5"
},
{
"last_affected": "2.9.0"
},
{
"last_affected": "2.9.0-rc0"
},
{
"last_affected": "2.9.0-rc1"
},
{
"last_affected": "2.9.0-rc2"
},
{
"last_affected": "2.9.1"
},
{
"last_affected": "2.9.2"
},
{
"last_affected": "2.9.3"
},
{
"last_affected": "2.9.4"
},
{
"last_affected": "2.10.0"
},
{
"last_affected": "2.10.0-rc0"
},
{
"last_affected": "2.10.0-rc1"
},
{
"last_affected": "2.10.0-rc2"
},
{
"last_affected": "2.10.1"
},
{
"last_affected": "2.10.2"
},
{
"last_affected": "2.10.3"
},
{
"last_affected": "2.11.0"
},
{
"last_affected": "2.11.0-rc0"
},
{
"last_affected": "2.11.0-rc1"
},
{
"last_affected": "2.11.0-rc2"
},
{
"last_affected": "2.11.0-rc3"
},
{
"last_affected": "2.11.1"
},
{
"last_affected": "2.11.2"
},
{
"last_affected": "2.12.0"
},
{
"last_affected": "2.12.0-rc0"
},
{
"last_affected": "2.12.0-rc1"
},
{
"last_affected": "2.12.0-rc2"
},
{
"last_affected": "2.12.1"
},
{
"last_affected": "2.12.2"
},
{
"last_affected": "2.12.3"
},
{
"last_affected": "2.13.0"
},
{
"last_affected": "2.13.0-rc0"
},
{
"last_affected": "2.13.0-rc1"
},
{
"last_affected": "2.13.0-rc2"
},
{
"last_affected": "2.13.1"
},
{
"last_affected": "2.13.2"
},
{
"last_affected": "2.13.3"
},
{
"last_affected": "2.13.4"
},
{
"last_affected": "2.14.0"
},
{
"last_affected": "2.14.0-rc0"
},
{
"last_affected": "2.14.0-rc1"
}
],
"cpe": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.0:rc3:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.9.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.10.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:rc3:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.0:rc1:*:*:*:*:*:*"
],
"source": "CPE_FIELD"
}