CVE-2015-8968GHSA-8GG6-3R63-25M8
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a git-fastclone ruby gem All versions before 1.0.1
git-fastclone ruby gem All versions before 1.0.1
- git-fastcloneRubyGems
fixed in 1.0.1