PublicDateAtUSN: 2017-05-10
Candidate: CVE-2017-8386
PublicDate: 2017-06-01 16:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8386
 http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html
 http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01346.html
 https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/
 https://ubuntu.com/security/notices/USN-3287-1
Description:
 git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7,
 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before
 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote
 authenticated users to gain privileges via a repository name that starts
 with a - (dash) character.
Ubuntu-Description:
Notes:
 tyhicks> Per upstream advisory, 1.6.1 is the earliest version affected
Bugs:
Priority: medium
Discovered-by: Timo Schmid
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [8.8 HIGH]

Patches_git:
 upstream: https://git.kernel.org/pub/scm/git/git.git/commit/?id=3ec804490a265f4c418a321428c12f3f18b7eff5
upstream_git: released (1:2.11.0-3)
precise/esm_git: DNE
trusty_git: released (1:1.9.1-1ubuntu0.5)
trusty/esm_git: DNE (trusty was released [1:1.9.1-1ubuntu0.5])
vivid/stable-phone-overlay_git: DNE
vivid/ubuntu-core_git: DNE
xenial_git: released (1:2.7.4-0ubuntu1.1)
esm-infra/xenial_git: released (1:2.7.4-0ubuntu1.1)
yakkety_git: released (1:2.9.3-1ubuntu0.1)
zesty_git: released (1:2.11.0-2ubuntu0.1)
devel_git: not-affected (1:2.11.0-3)