CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

The git subcommand cvsserver is a Perl script which makes excessive use of the backtick operator to invoke git. Unfortunately user input is used within some of those invocations, which can be a OS Command Injection vulnerability (CVE-2017-14867).

These are all security issues fixed in the git-2.33.0-1.3 package on the GA media of openSUSE Tumbleweed.

This update for git fixes the following issues:

• CVE-2017-14867: A cvsserver perl script command injection was fixed (CVE-2017-14867, bsc#1061041):

This update for git fixes the following issues:

This security issue was fixed:

• CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name (bsc#1061041).

This update for git fixes the following issues:

git was updated to 2.45.1:

• CVE-2024-32002: recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion (bsc#1224168)
• CVE-2024-32004: arbitrary code execution during local clones (bsc#1224170)
• CVE-2024-32020: file overwriting vulnerability during local clones (bsc#1224171)
• CVE-2024-32021: git may create hardlinks to arbitrary user- readable files (bsc#1224172)
• CVE-2024-32465: arbitrary code execution during clone operations (bsc#1224173)

Update to 2.45.0:

• Improved efficiency managing repositories with many references ("git init --ref-format=reftable")
• "git checkout -p" and friends learned that that "@" is a synonym for "HEAD"
• cli improvements handling refs
• Expanded a number of commands and options, UI improvements
• status.showUntrackedFiles now accepts "true"
• git-cherry-pick(1) now automatically drops redundant commits with new --empty option
• The userdiff patterns for C# has been updated.

Update to 2.44.0:

• "git checkout -B <branch>" now longer allows switching to a branch that is in use on another worktree. The users need to use "--ignore-other-worktrees" option.
• Faster server-side rebases with git replay
• Faster pack generation with multi-pack reuse
• rebase auto-squashing now works in non-interactive mode
• pathspec now understands attr, e.g. ':(attr:~binary) for selecting non-binaries, or builtin_objectmode for selecting items by file mode or other properties
• Many other cli UI and internal improvements and extensions

• Do not replace apparmor configuration, fixes bsc#1216545

Update to 2.43.2:

• https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.2.txt
• Update to a new feature recently added, "git show-ref --exists".
• Rename detection logic ignored the final line of a file if it is an incomplete line.
• "git diff --no-rename A B" did not disable rename detection but did not trigger an error from the command line parser.
• "git diff --no-index file1 file2" segfaulted while invoking the external diff driver, which has been corrected.
• A failed "git tag -s" did not necessarily result in an error depending on the crypto backend, which has been corrected.
• "git stash" sometimes was silent even when it failed due to unwritable index file, which has been corrected.
• Recent conversion to allow more than 0/1 in GIT_FLUSH broke the mechanism by flipping what yes/no means by mistake, which has been corrected.

Update to 2.43.1:

• https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.1.txt

• gitweb AppArmor profile: allow reading etc/gitweb-common.conf (bsc#1218664)

• git moved to /usr/libexec/git/git, update AppArmor profile accordingly (bsc#1218588)

Update to 2.43.0:

• The "--rfc" option of "git format-patch" used to be a valid way to override an earlier "--subject-prefix=<something>" on the command line and replace it with "[RFC PATCH]", but from this release, it merely prefixes the string "RFC " in front of the given subject prefix. If you are negatively affected by this change, please use "--subject-prefix=PATCH --rfc" as a replacement.
• In Git 2.42, "git rev-list --stdin" learned to take non-revisions (like "--not") from the standard input, but the way such a "--not" was handled was quite confusing, which has been rethought. The updated rule is that "--not" given from the command line only affects revs given from the command line that comes but not revs read from the standard input, and "--not" read from the standard input affects revs given from the standard input and not revs given from the command line.
• A message written in olden time prevented a branch from getting checked out, saying it is already checked out elsewhere. But these days, we treat a branch that…

It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker could possibly use this issue via shell metacharacters in modules names to execute arbitrary code.

This update also removes the cvsserver subcommand from git-shell by default.