ERNW GmbH 的 Timo Schmid 发现 Git git-shell（用于仅限 Git 的 SSH 访问的受限登录 shell）允许用户通过使其生成“git upload-pack --help”来运行交互式寻呼机。

Timo Schmid 发现 Git restricted shell 未能正确筛选允许的命令。远程攻击者可能利用此问题运行互动寻呼机以及访问敏感信息。

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

逃离 git-shell。在 git-shell 针对受限的 git-shell 命令组处理命令行选项的方式中发现缺陷。经身份验证的远程攻击者可利用此缺陷绕过 git-shell 限制，通过滥用以构建的命令行选项启动的 less 命令实例，查看并操纵文件。(CVE-2017-8386)

来自 Red Hat 安全公告 2017:2004： git 更新现可用于 Red Hat Enterprise Linux 7。 Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 Git 是一种包含分散式架构的分布式版本控制系统。与包含客户端服务器模型的集中化版本控制系统相反，Git 确保 Git 存储库每个工作的副本均为包含完整修订历史记录的实际副本。这便使用户不仅能够在不具备将更改送入官方存储库权限的情况下使用和促进项目，还能够在无网络连接情况下工作。 安全补丁： * 已发现 git 附带的 git-prompt.sh 脚本未正确处理包含特殊字符的分支名称。如果使用特制 git 存储库的用户将其 shell 配置为在提示中包含存储库信息，则存储库可利用此缺陷执行任意命令。 (CVE-2014-9938) * 在 git-shell 针对受限的 git-shell 命令组处理命令行选项的方式中发现缺陷。经身份验证的远程攻击者可利用此缺陷绕过 git-shell 限制，通过滥用以构建的命令行选项启动的 less 命令实例，查看并操纵文件。(CVE-2017-8386) 更多变更： 如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.4 版本说明。

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2491 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * A shell command injection flaw related to the handling of ssh URLs has been discovered in Git. An     attacker could use this flaw to execute shell commands with the privileges of the user running the Git     client, for example, when performing a clone action on a malicious repository or a legitimate repository     containing a malicious commit. (CVE-2017-1000117)

    * A flaw was found in the way git-shell handled command-line options for the restricted set of git-shell     commands. A remote, authenticated attacker could use this flaw to bypass git-shell restrictions, to view     and manipulate files, by abusing the instance of the less command launched using crafted command-line     options. (CVE-2017-8386)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before     2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might     allow remote authenticated users to gain privileges via a repository name that starts with a - (dash)     character. (CVE-2017-8386)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the git package has been released.

This update for git fixes the following issues :

  - git 2.12.3 :

  - CVE-2017-8386: Fix git-shell not to escape with the     starting dash name (bsc#1038395)

  - Fix for potential segv introduced in v2.11.0 and later

  - Misc fixes and cleanups.

  - git 2.12.2 :

  - CLI output fixes

  - 'Dump http' transport fixes

  - various fixes for internal code paths 

  - Trailer 'Cc:' RFC fix

  - git 2.12.1 :

  - Reduce authentication round-trip over HTTP when the     server supports just a single authentication method.

  - 'git add -i' patch subcommand fixed to have a path     selection

  - various path verification fixes

  - fix 'git log -L...' buffer overrun

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is affected by the vulnerability described in GLSA-201706-04 (Git: Security bypass)

    Timo Schmid discovered that the Git restricted shell incorrectly       filtered allowed commands.
  Impact :

    A remote attacker could possibly bypass security restrictions and access       sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135580	SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)	Nessus	SuSE Local Security Checks	2020/4/15	2022/5/13	critical
100111	Debian DSA-3848-1：git - 安全更新	Nessus	Debian Local Security Checks	2017/5/11	2021/1/11	high
100218	Ubuntu 14.04 LTS / 16.04 LTS：Git 漏洞 (USN-3287-1)	Nessus	Ubuntu Local Security Checks	2017/5/16	2024/8/27	high
100643	Amazon Linux AMI : git (ALAS-2017-842)	Nessus	Amazon Linux Local Security Checks	2017/6/7	2018/4/18	high
102294	Oracle Linux 7 : git (ELSA-2017-2004)	Nessus	Oracle Linux Local Security Checks	2017/8/9	2024/11/1	high
210316	RHEL 6 / 7 : rh-git29-git (RHSA-2017:2491)	Nessus	Red Hat Local Security Checks	2024/11/5	2025/4/29	high
221316	Linux Distros Unpatched Vulnerability : CVE-2017-8386	Nessus	Misc.	2025/3/4	2025/8/20	high
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	2025/8/19	2025/8/23	high
100500	openSUSE Security Update : git (openSUSE-2017-624)	Nessus	SuSE Local Security Checks	2017/5/30	2021/1/19	high
100647	GLSA-201706-04 : Git: Security bypass	Nessus	Gentoo Local Security Checks	2017/6/7	2021/1/11	high

检测

插件搜索

critical

high

high

high

high

high

high

high

high

high