DSA-3934-1 git -- security update

Debian Security Advisory

DSA-3934-1 git -- security update

Date Reported:

10 Aug 2017

Affected Packages:

git

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2017-1000117.

More information:

Joern Schneeweisz discovered that git, a distributed revision control system, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via git submodules.

For the oldstable distribution (jessie), this problem has been fixed in version 1:2.1.4-2.1+deb8u4.

For the stable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u1.

We recommend that you upgrade your git packages.