Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 569
Alerts This Week
Warning Icon 1 569

Gentoo: GLSA-201706-04 Moderate: Git Remote Access Bypass

gentoo
Calendar Grey June 6, 2017
Scroller Gentoo
Gentoo GLSA-202112-01 addresses a vulnerability in OpenSSL that could lead to data leakage. Immediate patching is recommended.
A vulnerability in Git might allow remote attackers to bypass security restrictions.

Summary

Timo Schmid discovered that the Git restricted shell incorrectly filtered allowed commands.

Topics%20covered

Topics Covered

security advisory gentoo remote access update recommended normal severity git security bypass

Resolution

All Git users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.13.0"

References

[ 1 ] CVE-2017-8386 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8386

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201706-04
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: Git: Security bypass
Date: June 06, 2017
Bugs: #618126
ID: 201706-04

Topics%20covered

Topics Covered

security advisory gentoo remote access update recommended normal severity git security bypass

Synopsis

A vulnerability in Git might allow remote attackers to bypass security restrictions.

Background

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-vcs/git < 2.13.0 >= 2.13.0

Impact

===== A remote attacker could possibly bypass security restrictions and access sensitive information.

Workaround

There is no known workaround at this time.