Vulnerability Report: GO-2021-0073
- CVE-2017-17831, GHSA-w4xh-w33p-4v29
- Affects: github.com/git-lfs/git-lfs
- Published: Apr 14, 2021
- Modified: Jun 12, 2023
Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository.
Affected Packages
-
PathVersionsSymbols
-
before v2.1.1-0.20170519163204-f913f5f9c7c6+incompatible
Aliases
References
- https://github.com/git-lfs/git-lfs/pull/2241
- https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19
- http://blog.recurity-labs.com/2017-08-10/scm-vulns
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
- http://www.securityfocus.com/bid/102926
- https://vuln.go.dev/ID/GO-2021-0073.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.