https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T01:09:40.181937+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2017-14867 CVE-2017-14867 2026-10-05T01:09:41.284398+00:00

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

 https://vulnerability.circl.lu/vuln/usn-3438-1 USN-3438-1 — git vulnerability 2026-10-05T01:09:41.284632+00:00

Affected: Ubuntu:14.04:LTS: git, Ubuntu:16.04:LTS: git

It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker could possibly use this issue via shell metacharacters in modules names to execute arbitrary code.

This update also removes the cvsserver subcommand from git-shell by default.