Sha256: 464321f6990ab80a0b0b4c89d51460375b3ff6c393491a19d80b64efa6e5b1a9
Contents?: true
Size: 943 Bytes
Versions: 5
Compression:
Stored size: 943 Bytes
Contents
--- gem: git-fastclone cve: 2015-8968 url: https://hackerone.com/reports/104465 title: git-fastclone permits arbitrary shell command execution from .gitmodules date: 2015-12-11 description: | Git allows executing arbitrary shell commands using git-remote-ext via a remote URLs. Normally git never requests URLs that the user doesn't specifically request, so this is not a serious security concern. However, submodules did allow the remote repository to specify what URL to clone from. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories. patched_versions: - ">= 1.0.1"
Version data entries
5 entries across 5 versions & 2 rubygems