Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
{
"unresolved_ranges": [
{
"vendor_product": "debian:debian_linux",
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"last_affected": "8.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}{
"cpe": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.5:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.1:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "2.10.4"
},
{
"last_affected": "2.11.0"
},
{
"last_affected": "2.11.1"
},
{
"last_affected": "2.11.2"
},
{
"last_affected": "2.11.3"
},
{
"last_affected": "2.12.0"
},
{
"last_affected": "2.12.1"
},
{
"last_affected": "2.12.2"
},
{
"last_affected": "2.12.3"
},
{
"last_affected": "2.12.4"
},
{
"last_affected": "2.13.0"
},
{
"last_affected": "2.13.1"
},
{
"last_affected": "2.13.2"
},
{
"last_affected": "2.13.3"
},
{
"last_affected": "2.13.4"
},
{
"last_affected": "2.13.5"
},
{
"last_affected": "2.14.0"
},
{
"last_affected": "2.14.1"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}{
"cpe": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.11.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.12.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.13.5:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*",
"cpe:2.3:a:git-scm:git:2.14.1:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "2.10.4"
},
{
"last_affected": "2.11.0"
},
{
"last_affected": "2.11.1"
},
{
"last_affected": "2.11.2"
},
{
"last_affected": "2.11.3"
},
{
"last_affected": "2.12.0"
},
{
"last_affected": "2.12.1"
},
{
"last_affected": "2.12.2"
},
{
"last_affected": "2.12.3"
},
{
"last_affected": "2.12.4"
},
{
"last_affected": "2.13.0"
},
{
"last_affected": "2.13.1"
},
{
"last_affected": "2.13.2"
},
{
"last_affected": "2.13.3"
},
{
"last_affected": "2.13.4"
},
{
"last_affected": "2.13.5"
},
{
"last_affected": "2.14.0"
},
{
"last_affected": "2.14.1"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}