{"id":"CVE-2017-8386","aliases":["ALPINE-CVE-2017-8386","BELL-CVE-2017-8386","DEBIAN-CVE-2017-8386","DLA-938-1","DSA-3848-1","EUVD-2017-17339","GHSA-xqh5-ghjx-6xv5","MGASA-2017-0153","RHSA-2017:2004","RHSA-2017:2491","SUSE-SU-2017:1357-1","SUSE-SU-2017:1432-1","UBUNTU-CVE-2017-8386","USN-3287-1","openSUSE-SU-2024:10786-1"],"status":"published","title":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x...","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.12387,"percentile":0.96232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2017-05-10T00:00:00Z","modified":"2026-09-01T20:03:51Z","exploits":[{"source":"pocgithub","id":"suz1n/WHS3_vulhub","title":"suz1n/WHS3_vulhub","date":"2025-04-27","url":"https://github.com/suz1n/WHS3_vulhub"}],"fixes":[{"ecosystem":"Alpine:v3.3","package":"git","fixed_in":["2.6.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"git","fixed_in":["1:2.11.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"git","fixed_in":["1:2.11.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"git","fixed_in":["1:2.11.0-3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"git","fixed_in":["1:1.7.10.4-1+wheezy4"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"git","fixed_in":["1:2.1.4-2.1+deb8u3"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"git","fixed_in":["2.7.4-1.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"git","fixed_in":["2.12.3-26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"git","fixed_in":["1.7.12.4-0.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Studio Onsite 1.3","package":"git","fixed_in":["1.7.12.4-0.17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"git","fixed_in":["1:1.9.1-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"git","fixed_in":["1:2.7.4-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11.0-3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.10.4-1+wheezy4"}]}],"versions":["1:1.7.10.4-1+wheezy1","1:1.7.10.4-1+wheezy2","1:1.7.10.4-1+wheezy3"]},{"source":"osv","ecosystem":"Debian:8","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.4-2.1+deb8u3"}]}],"versions":["1:2.1.4-2.1","1:2.1.4-2.1+deb8u1","1:2.1.4-2.1+deb8u2"]},{"source":"osv","ecosystem":"Mageia:5","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"emacs-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"emacs-git-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-bzr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-hg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"emacs-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"emacs-git-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-bzr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-hg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"emacs-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"emacs-git-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-bzr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-hg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"emacs-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"emacs-git-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-bzr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-hg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-emacs-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-emacs-git-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-git29-perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-git29-perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.12.4-0.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.12.4-0.17.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.1-1ubuntu0.5"}]}],"versions":["1:1.8.3.2-1","1:1.8.4.2-1","1:1.8.4.3-1","1:1.8.4.4-1","1:1.8.5-1","1:1.8.5.1-1","1:1.8.5.2-1","1:1.8.5.2-2","1:1.8.5.3-1","1:1.9~rc1-1","1:1.9.0-1","1:1.9.1-1","1:1.9.1-1ubuntu0.1","1:1.9.1-1ubuntu0.2","1:1.9.1-1ubuntu0.3","1:1.9.1-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.1"}]}],"versions":["1:2.5.0-1","1:2.6.2-1","1:2.6.3-1","1:2.6.4-1","1:2.7.0~rc3-1","1:2.7.0-1","1:2.7.3-0ubuntu1","1:2.7.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.1-1ubuntu0.5"}]}],"versions":["1:1.8.3.2-1","1:1.8.4.2-1","1:1.8.4.3-1","1:1.8.4.4-1","1:1.8.5-1","1:1.8.5.1-1","1:1.8.5.2-1","1:1.8.5.2-2","1:1.8.5.3-1","1:1.9~rc1-1","1:1.9.0-1","1:1.9.1-1","1:1.9.1-1ubuntu0.1","1:1.9.1-1ubuntu0.2","1:1.9.1-1ubuntu0.3","1:1.9.1-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.1"}]}],"versions":["1:2.5.0-1","1:2.6.2-1","1:2.6.3-1","1:2.6.4-1","1:2.7.0~rc3-1","1:2.7.0-1","1:2.7.3-0ubuntu1","1:2.7.4-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.0-1.3"}]}],"bundled":21}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"git","product":"git-shell"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3287-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201706-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","advisory","report"]},{"url":"https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1038479","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2491","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2004","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/98409","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3848","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8386","tags":["advisory"]},{"url":"https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF"},{"url":"http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com"},{"url":"http://public-inbox.org/git/xmqq8tm5ziat.fsf@gitster.mtv.corp.google.com"},{"url":"https://github.com/advisories/GHSA-xqh5-ghjx-6xv5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-8386","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-8386","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8386","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0153.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20827","tags":["report"]},{"url":"https://www.debian.org/security/2017/dsa-3848","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1434415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450407","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2004.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8386","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480386","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2491.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000117","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000117","tags":["advisory"]},{"url":"http://blog.recurity-labs.com/2017-08-10/scm-vulns","tags":["article"]},{"url":"https://lkml.org/lkml/2017/8/10/757","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171357-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1038395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8386","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171432-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-8386","tags":["report"]},{"url":"http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html","tags":["report"]},{"url":"http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01346.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3287-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-4900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21300","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-06-01T16:00:00Z","modified":"2024-08-05T16:34:22.74Z","updated_at":"2026-11-02T14:33:15.201133Z"}],"euvd":[{"id":"EUVD-2017-17339","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-06-01T16:00:00Z","modified":"2024-08-05T16:34:22Z","updated_at":"2026-11-03T02:39:05.365606Z"}],"ghsa":[{"id":"GHSA-xqh5-ghjx-6xv5","title":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x...","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2022-05-13T01:47:31Z","modified":"2025-04-20T03:39:26Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:47.375435Z"}],"nvd":[{"id":"CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-06-01T16:29:00.45Z","modified":"2026-06-17T01:26:17.773Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:49.449157Z"}],"osv":[{"id":"ALPINE-CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-06-01T16:29:00.45Z","modified":"2026-06-15T18:25:00.927957593Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2017-8386","title":"CVE-2017-8386 does not affect BellSoft software","status":"withdrawn","published":"2017-06-01T16:29:00Z","modified":"2026-01-26T09:49:06.723624Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-06-01T16:29:00.45Z","modified":"2026-04-16T06:15:29.971532999Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-06-01T16:29:00.45Z","modified":"2026-09-01T20:03:51.035688667Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"RHSA-2017:2004","title":"Red Hat Security Advisory: git security and bug fix update","status":"published","published":"2024-09-16T00:08:24Z","modified":"2026-06-29T10:17:07Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2491","title":"Red Hat Security Advisory: rh-git29-git security update","status":"published","published":"2024-09-13T16:49:39Z","modified":"2026-08-05T10:04:40Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.","status":"published","published":"2017-05-10T00:00:00Z","modified":"2026-02-04T02:42:08.665014Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-938-1","title":"git - security update","status":"published","published":"2017-05-10T00:00:00Z","modified":"2026-03-09T02:11:07.05711Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3848-1","title":"git - security update","status":"published","published":"2017-05-10T00:00:00Z","modified":"2026-03-09T01:20:10.714454Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0153","title":"Updated git packages fix security vulnerability","description":"Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted\nlogin shell for Git-only SSH access, allows a user to run an interactive\npager by causing it to spawn \"git upload-pack --help\" (CVE-2017-8386).\n","status":"published","published":"2017-06-03T23:35:54Z","modified":"2026-04-16T06:22:22.022004294Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10786-1","title":"git-2.33.0-1.3 on GA media","description":"These are all security issues fixed in the git-2.33.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:41.806246Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:1357-1","title":"Security update for git","description":"\nThis update for git fixes the following issues:\n\n- git 2.12.3:\n * CVE-2017-8386: Fix git-shell not to escape with the starting dash name\n   (bsc#1038395)\n * Fix for potential segv introduced in v2.11.0 and later\n * Misc fixes and cleanups.\n- git 2.12.2:\n  * CLI output fixes\n  * 'Dump http' transport fixes\n  * various fixes for internal code paths   \n  * Trailer 'Cc:' RFC fix\n- git 2.12.1:\n  * Reduce authentication round-trip over HTTP when the server\n    supports just a single authentication method.\n  * 'git add -i' patch subcommand fixed to have a path selection\n  * various path verification fixes\n  * fix 'git log -L...' buffer overrun\n","status":"published","published":"2017-05-19T07:22:11Z","modified":"2026-02-04T04:23:56.900173Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1432-1","title":"Security update for git","description":"\nThis update for git fixes the following issue:\n\n- CVE-2017-8386: git shell, may allow a user who comes over SSH to run an\ninteractive pager by causing it to spawn 'git upload-pack --help' (bsc#1038395):\n","status":"published","published":"2017-05-29T07:01:09Z","modified":"2026-02-04T03:55:01.89445Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3287-1","title":"git vulnerability","description":"Timo Schmid discovered that the Git restricted shell incorrectly filtered\nallowed commands. A remote attacker could possibly use this issue to run an\ninteractive pager and access sensitive information.\n","status":"published","published":"2017-05-15T13:52:14Z","modified":"2026-02-10T04:41:07Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}