Bug 618126 – <dev-vcs/git-2.13.0: escape out of git-shell (CVE-2017-8386)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description dwfreed 2017-05-10 17:16:15 UTC]

From [1]:

Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help".

See ${URL} for full details.  (It's not very succinct, which is why I pulled the summary from the Debian Security Advisory.)

Polynomial-C already added dev-vcs/git-2.13.0 to the tree, which contains a fix for this issue, so all that's left is stabilization.

Side note: Gentoo Infrastructure is not vulnerable, due to using gitolite for git SSH access.

[1]: https://www.debian.org/security/2017/dsa-3848

[Comment 1 Yury German 2017-05-11 07:04:10 UTC]

Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.

[Comment 2 Lars Wendler (Polynomial-C) (RETIRED) 2017-05-11 13:20:48 UTC]

Arches please test and mark stable =dev-vcs/git-2.13.0 with target KEYWORDS:

alpha amd64 arm ~arm64 hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris

[Comment 3 Agostino Sarubbo 2017-05-11 14:41:34 UTC]

amd64 stable

[Comment 4 Teika kazura 2017-05-11 22:58:26 UTC]

Not only v2.13.0, but also versions v2.4.12, v2.5.6, v2.6.7, v2.7.5, v2.8.5, v2.9.4, v2.10.3, v2.11.2, and v2.12.3 have this (CVE-2017-8386) fix, too:
  http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html

[Comment 5 Yury German 2017-05-12 04:02:13 UTC]

(In reply to Teika kazura from comment #4)
> Not only v2.13.0, but also versions v2.4.12, v2.5.6, v2.6.7, v2.7.5, v2.8.5,
> v2.9.4, v2.10.3, v2.11.2, and v2.12.3 have this (CVE-2017-8386) fix, too:
>   http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html

We only have version 2.10.X in tree, so while the others are vulnerable they do not apply to Gentoo.

[Comment 6 Agostino Sarubbo 2017-05-12 14:58:31 UTC]

sparc stable

[Comment 7 Tobias Klausmann (RETIRED) 2017-05-12 17:59:06 UTC]

Stable on alpha.

[Comment 8 Jeroen Roovers (RETIRED) 2017-05-13 11:09:10 UTC]

Stable for HPPA.

[Comment 9 Markus Meier 2017-05-16 04:44:19 UTC]

arm stable

[Comment 10 Agostino Sarubbo 2017-05-16 08:02:07 UTC]

x86 stable

[Comment 11 Agostino Sarubbo 2017-05-16 13:08:13 UTC]

ppc64 stable

[Comment 12 Michael Weber (RETIRED) 2017-05-16 22:00:34 UTC]

ppc stable.

[Comment 13 Yury German 2017-05-18 06:03:43 UTC]

New GLSA Request filed.

please continue stabilization for ia64

[Comment 14 Sergei Trofimovich (RETIRED) 2017-05-20 18:35:29 UTC]

ia64 stable. Last arch.

[Comment 15 Thomas Deutschmann (RETIRED) 2017-06-03 21:33:10 UTC]

@ Maintainer(s): Please cleanup and drop =dev-vcs/git-2.12.3!

[Comment 16 GLSAMaker/CVETool Bot 2017-06-06 08:48:47 UTC]

This issue was resolved and addressed in
 GLSA 201706-04 at https://security.gentoo.org/glsa/201706-04
by GLSA coordinator Thomas Deutschmann (whissi).

[Comment 17 Thomas Deutschmann (RETIRED) 2017-06-06 08:52:51 UTC]

Re-opening for cleanup.

Cleanup PR: https://github.com/gentoo/gentoo/pull/4868

[Comment 18 Thomas Deutschmann (RETIRED) 2017-06-08 07:37:50 UTC]

Now cleaned up, all done.