Ubuntu 17.04 USN-3387-1 Moderate Git Remote Code Execution Advisory

ubuntu

August 11, 2017

Git could be made run programs as your login if it opened a speciallycrafted git repository.

Summary

Git could be made run programs as your login if it opened a specially

crafted git repository.

Software Description:

- git: fast, scalable, distributed revision control system

Details:

Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did

not properly handle host names in 'ssh://' URLs. A remote attacker

could use this to construct a git repository that when accessed could

run arbitrary code with the privileges of the user.

Topics Covered

security advisory remote code execution Ubuntu Moderate severity git flaw

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  git                             1:2.11.0-2ubuntu0.2

Ubuntu 16.04 LTS:
  git                             1:2.7.4-0ubuntu1.2

Ubuntu 14.04 LTS:
  git                             1:1.9.1-1ubuntu0.6

In general, a standard system update will make all the necessary changes.