Details on this are a bit scarce, but it seems git has another security issue: https://public-inbox.org/git/xmqqwp4m9ejl.fsf@gitster.mtv.corp.google.com/ This is the relevant part: * "git cvsserver" no longer is invoked by "git shell" by default, as it is old and largely unmaintained. [...] Credits go to joernchen <joernchen@phenoelit.de> for finding the unsafe constructs in "git cvsserver", and to Jeff King at GitHub for finding and fixing instances of the same issue in other scripts. joernchen is the same person who found the previous command injection vulns (see #627488) in git, so I assume this is a related / similar issue. Fixed in 2.10.5, 2.11.4, 2.12.5, 2.13.6, v2.14.2. Given that we don't support anything before 2.13 please bump to 2.13.6 and 2.14.2.
More details from the bug finder: http://www.phenoelit.org/stuff/git_cvsserver.txt
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e62b37dd27a9bb9574fcfb3fe98fae76776e90e2 commit e62b37dd27a9bb9574fcfb3fe98fae76776e90e2 Author: Robin H. Johnson <robbat2@gentoo.org> AuthorDate: 2017-09-26 17:01:48 +0000 Commit: Robin H. Johnson <robbat2@gentoo.org> CommitDate: 2017-09-26 17:03:13 +0000 dev-vcs/git: security bump. Bug: https://bugs.gentoo.org/632036 Package-Manager: Portage-2.3.8, Repoman-2.3.3 dev-vcs/git/Manifest | 6 + dev-vcs/git/git-2.13.6.ebuild | 680 ++++++++++++++++++++++++++++++++++++++++ dev-vcs/git/git-2.14.2.ebuild | 699 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 1385 insertions(+)}
Arches, please test & stabilize. Target keywords: alpha, amd64, arm, hppa, ia64, ppc, x86 FEATURES=test is supported. Expected final test output: ... done | '/bin/sh' ./aggregate-results.sh fixed 0 success 16087 failed 0 broken 212 total 16483 >>> Completed testing dev-vcs/git-2.13.6
amd64 stable
CVE assigned: 9/28/17 CVE-2017-14867(https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14867)
ppc64 stable
ppc stable
ia64 stable
hppa stable
x86 stable
arm stable
Stable on alpha.
GLSA Vote: No @maintainers, please clean the vulnerable versions.
sparc stable (thanks to Rolf Eike Beer)
Tree is clean.
