CVE-2015-7545

critical
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

References

http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html

http://rhn.redhat.com/errata/RHSA-2015-2515.html

http://www.debian.org/security/2016/dsa-3435

http://www.openwall.com/lists/oss-security/2015/12/08/5

http://www.openwall.com/lists/oss-security/2015/12/09/8

http://www.openwall.com/lists/oss-security/2015/12/11/7

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.securityfocus.com/bid/78711

http://www.securitytracker.com/id/1034501

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255

http://www.ubuntu.com/usn/USN-2835-1

https://bugzilla.redhat.com/show_bug.cgi?id=1269794

https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt

https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt

https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt

https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt

https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021

https://lkml.org/lkml/2015/10/5/683

https://security.gentoo.org/glsa/201605-01

Details

Source: MITRE

Published: 2016-04-13

Updated: 2018-10-30

Type: CWE-20

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL

Tenable Plugins

View all (11 total)

IDNameProductFamilySeverity
124923EulerOS Virtualization 3.0.1.0 : git (EulerOS-SA-2019-1420)NessusHuawei Local Security Checks
critical
90849GLSA-201605-01 : Git: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
90836Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : mercurial (SSA:2016-123-01)NessusSlackware Local Security Checks
critical
87742Debian DSA-3435-1 : git - security updateNessusDebian Local Security Checks
critical
87589SUSE SLES12 Security Update : Recommended update for git (SUSE-SU-2015:2325-1)NessusSuSE Local Security Checks
critical
87407Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : git vulnerability (USN-2835-1)NessusUbuntu Local Security Checks
critical
87339Amazon Linux AMI : git (ALAS-2015-613)NessusAmazon Linux Local Security Checks
critical
87282CentOS 7 : git (CESA-2015:2561)NessusCentOS Local Security Checks
critical
87275RHEL 7 : git (RHSA-2015:2561)NessusRed Hat Local Security Checks
critical
87272Oracle Linux 7 : git (ELSA-2015-2561)NessusOracle Linux Local Security Checks
critical
86450FreeBSD : Git -- Execute arbitrary code (7f645ee5-7681-11e5-8519-005056ac623e)NessusFreeBSD Local Security Checks
critical