Ubuntu
git package

Please update Git to get the fix to CVE-2017-1000117

Bug #1710016 reported by Jonathan Nieder
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
git (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

A security bugfix was released today to Git: https://<email address hidden>/T/#u.

Without it, cloning an attacker-controlled ssh:// URL (either directly or indirectly via submodules) leads to arbitrary code execution.

CVE References

Revision history for this message
Jonathan Nieder (jrnieder) wrote :

+linkcve doesn't like the shape of 2017-1000117 or CVE-2017-1000117 so I can't link it.

information type: Private Security → Public Security
Revision history for this message
Steve Beattie (sbeattie) wrote :

This has been addressed for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 17.04 in https://usn.ubuntu.com/usn/usn-3387-1/.

Thanks!

Revision history for this message
Jonathan Nieder (jrnieder) wrote :

Thanks. Is there a reason zesty has custom security patches instead of reusing the work from Debian stretch?

Marc Deslauriers (mdeslaur)
Changed in git (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.