Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

git: arbitrary code execution

Package(s):

git

CVE #(s):

CVE-2008-5517

Created:

January 12, 2009

Updated:

March 9, 2009

Description:

From the SUSE advisory:

Insufficient quoting of shell characters allowed remote attackers to execute arbitrary commands via the git web interface (CVE-2008-5517)

Alerts:

(Log in to post comments)

git: arbitrary code execution

Posted Jan 15, 2009 12:22 UTC (Thu) by cortana (subscriber, #24596) [Link]

Are the versions in Debian's stable and backports repositories vulnerable to this?

1.4.4.4 and 1.5.6.5 respectively.

git: arbitrary code execution

Posted Jan 20, 2009 14:32 UTC (Tue) by fbriere (subscriber, #4961) [Link]

It depends, as there are actually two issues at stake. Hopefully, DSA-1708-1 should provide you with all the information you need.