Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities found for git-fastclone by squareup

    CVE-2015-8969 (GCVE-0-2015-8969)

    Vulnerability from nvd – Published: 2016-11-03 10:00 – Updated: 2024-08-06 08:36
    VLAI
    Summary
    git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.
    Severity
    No CVSS data available.
    CWE
    • Arbitrary Command Execution
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a git-fastclone ruby gem All versions before 1.0.5 Affected: git-fastclone ruby gem All versions before 1.0.5
    Date Public
    2016-11-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "81433",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/81433"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/square/git-fastclone/pull/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/105190"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git-fastclone ruby gem All versions before 1.0.5",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "git-fastclone ruby gem All versions before 1.0.5"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to \"cd \" and \"git clone \" commands in the library."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary Command Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "name": "81433",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/81433"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/git-fastclone/pull/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/105190"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2015-8969",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "git-fastclone ruby gem All versions before 1.0.5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "git-fastclone ruby gem All versions before 1.0.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to \"cd \" and \"git clone \" commands in the library."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Arbitrary Command Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "81433",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/81433"
            },
            {
              "name": "https://github.com/square/git-fastclone/pull/5",
              "refsource": "MISC",
              "url": "https://github.com/square/git-fastclone/pull/5"
            },
            {
              "name": "https://hackerone.com/reports/105190",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/105190"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2015-8969",
    "datePublished": "2016-11-03T10:00:00.000Z",
    "dateReserved": "2016-11-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2015-8968 (GCVE-0-2015-8968)

    Vulnerability from nvd – Published: 2016-11-03 10:00 – Updated: 2024-08-06 08:36
    VLAI
    Summary
    git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
    Severity
    No CVSS data available.
    CWE
    • Arbitrary Command Execution
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a git-fastclone ruby gem All versions before 1.0.1 Affected: git-fastclone ruby gem All versions before 1.0.1
    Date Public
    2016-11-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/104465"
          },
          {
            "name": "81433",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/81433"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/square/git-fastclone/pull/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git-fastclone ruby gem All versions before 1.0.1",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "git-fastclone ruby gem All versions before 1.0.1"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary Command Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/104465"
        },
        {
          "name": "81433",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/81433"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/git-fastclone/pull/2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2015-8968",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "git-fastclone ruby gem All versions before 1.0.1",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "git-fastclone ruby gem All versions before 1.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Arbitrary Command Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/104465",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/104465"
            },
            {
              "name": "81433",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/81433"
            },
            {
              "name": "https://github.com/square/git-fastclone/pull/2",
              "refsource": "MISC",
              "url": "https://github.com/square/git-fastclone/pull/2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2015-8968",
    "datePublished": "2016-11-03T10:00:00.000Z",
    "dateReserved": "2016-11-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2015-8969 (GCVE-0-2015-8969)

    Vulnerability from cvelistv5 – Published: 2016-11-03 10:00 – Updated: 2024-08-06 08:36
    VLAI
    Summary
    git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.
    Severity
    No CVSS data available.
    CWE
    • Arbitrary Command Execution
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a git-fastclone ruby gem All versions before 1.0.5 Affected: git-fastclone ruby gem All versions before 1.0.5
    Date Public
    2016-11-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "81433",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/81433"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/square/git-fastclone/pull/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/105190"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git-fastclone ruby gem All versions before 1.0.5",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "git-fastclone ruby gem All versions before 1.0.5"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to \"cd \" and \"git clone \" commands in the library."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary Command Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "name": "81433",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/81433"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/git-fastclone/pull/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/105190"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2015-8969",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "git-fastclone ruby gem All versions before 1.0.5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "git-fastclone ruby gem All versions before 1.0.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to \"cd \" and \"git clone \" commands in the library."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Arbitrary Command Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "81433",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/81433"
            },
            {
              "name": "https://github.com/square/git-fastclone/pull/5",
              "refsource": "MISC",
              "url": "https://github.com/square/git-fastclone/pull/5"
            },
            {
              "name": "https://hackerone.com/reports/105190",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/105190"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2015-8969",
    "datePublished": "2016-11-03T10:00:00.000Z",
    "dateReserved": "2016-11-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2015-8968 (GCVE-0-2015-8968)

    Vulnerability from cvelistv5 – Published: 2016-11-03 10:00 – Updated: 2024-08-06 08:36
    VLAI
    Summary
    git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
    Severity
    No CVSS data available.
    CWE
    • Arbitrary Command Execution
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a git-fastclone ruby gem All versions before 1.0.1 Affected: git-fastclone ruby gem All versions before 1.0.1
    Date Public
    2016-11-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/104465"
          },
          {
            "name": "81433",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/81433"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/square/git-fastclone/pull/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git-fastclone ruby gem All versions before 1.0.1",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "git-fastclone ruby gem All versions before 1.0.1"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary Command Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/104465"
        },
        {
          "name": "81433",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/81433"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/git-fastclone/pull/2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2015-8968",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "git-fastclone ruby gem All versions before 1.0.1",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "git-fastclone ruby gem All versions before 1.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Arbitrary Command Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/104465",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/104465"
            },
            {
              "name": "81433",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/81433"
            },
            {
              "name": "https://github.com/square/git-fastclone/pull/2",
              "refsource": "MISC",
              "url": "https://github.com/square/git-fastclone/pull/2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2015-8968",
    "datePublished": "2016-11-03T10:00:00.000Z",
    "dateReserved": "2016-11-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}