https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 01:09:39 +0000 https://vulnerability.circl.lu/vuln/cve-2017-14867 <p>Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.</p> <p>Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.</p> https://vulnerability.circl.lu/vuln/cve-2017-14867 https://vulnerability.circl.lu/vuln/usn-3438-1 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: git, Ubuntu:16.04:LTS: git</p> <p>It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker could possibly use this issue via shell metacharacters in modules names to execute arbitrary code.</p> <p>This update also removes the cvsserver subcommand from git-shell by default.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: git, Ubuntu:16.04:LTS: git</p> <p>It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker could possibly use this issue via shell metacharacters in modules names to execute arbitrary code.</p> <p>This update also removes the cvsserver subcommand from git-shell by default.</p> https://vulnerability.circl.lu/vuln/usn-3438-1