Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 618126 (CVE-2017-8386) - <dev-vcs/git-2.13.0: escape out of git-shell (CVE-2017-8386)
Summary: <dev-vcs/git-2.13.0: escape out of git-shell (CVE-2017-8386)
Status: RESOLVED FIXED
Alias: CVE-2017-8386
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://insinuator.net/2017/05/git-sh...
Whiteboard: B2 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-10 17:16 UTC by dwfreed
Modified: 2017-06-08 07:37 UTC (History)
2 users (show)

See Also:
Package list:
=dev-vcs/git-2.13.0
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description dwfreed 2017-05-10 17:16:15 UTC
From [1]:

Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help".

See ${URL} for full details.  (It's not very succinct, which is why I pulled the summary from the Debian Security Advisory.)

Polynomial-C already added dev-vcs/git-2.13.0 to the tree, which contains a fix for this issue, so all that's left is stabilization.

Side note: Gentoo Infrastructure is not vulnerable, due to using gitolite for git SSH access.

[1]: https://www.debian.org/security/2017/dsa-3848
Comment 1 Yury German Gentoo Infrastructure gentoo-dev 2017-05-11 07:04:10 UTC
Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.
Comment 2 Lars Wendler (Polynomial-C) gentoo-dev 2017-05-11 13:20:48 UTC
Arches please test and mark stable =dev-vcs/git-2.13.0 with target KEYWORDS:

alpha amd64 arm ~arm64 hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris
Comment 3 Agostino Sarubbo gentoo-dev 2017-05-11 14:41:34 UTC
amd64 stable
Comment 4 Teika kazura 2017-05-11 22:58:26 UTC
Not only v2.13.0, but also versions v2.4.12, v2.5.6, v2.6.7, v2.7.5, v2.8.5, v2.9.4, v2.10.3, v2.11.2, and v2.12.3 have this (CVE-2017-8386) fix, too:
  http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html
Comment 5 Yury German Gentoo Infrastructure gentoo-dev 2017-05-12 04:02:13 UTC
(In reply to Teika kazura from comment #4)
> Not only v2.13.0, but also versions v2.4.12, v2.5.6, v2.6.7, v2.7.5, v2.8.5,
> v2.9.4, v2.10.3, v2.11.2, and v2.12.3 have this (CVE-2017-8386) fix, too:
>   http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html

We only have version 2.10.X in tree, so while the others are vulnerable they do not apply to Gentoo.
Comment 6 Agostino Sarubbo gentoo-dev 2017-05-12 14:58:31 UTC
sparc stable
Comment 7 Tobias Klausmann (RETIRED) gentoo-dev 2017-05-12 17:59:06 UTC
Stable on alpha.
Comment 8 Jeroen Roovers (RETIRED) gentoo-dev 2017-05-13 11:09:10 UTC
Stable for HPPA.
Comment 9 Markus Meier gentoo-dev 2017-05-16 04:44:19 UTC
arm stable
Comment 10 Agostino Sarubbo gentoo-dev 2017-05-16 08:02:07 UTC
x86 stable
Comment 11 Agostino Sarubbo gentoo-dev 2017-05-16 13:08:13 UTC
ppc64 stable
Comment 12 Michael Weber (RETIRED) gentoo-dev 2017-05-16 22:00:34 UTC
ppc stable.
Comment 13 Yury German Gentoo Infrastructure gentoo-dev 2017-05-18 06:03:43 UTC
New GLSA Request filed.

please continue stabilization for ia64
Comment 14 Sergei Trofimovich (RETIRED) gentoo-dev 2017-05-20 18:35:29 UTC
ia64 stable. Last arch.
Comment 15 Thomas Deutschmann gentoo-dev 2017-06-03 21:33:10 UTC
@ Maintainer(s): Please cleanup and drop =dev-vcs/git-2.12.3!
Comment 16 GLSAMaker/CVETool Bot gentoo-dev 2017-06-06 08:48:47 UTC
This issue was resolved and addressed in
 GLSA 201706-04 at https://security.gentoo.org/glsa/201706-04
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 17 Thomas Deutschmann gentoo-dev 2017-06-06 08:52:51 UTC
Re-opening for cleanup.

Cleanup PR: https://github.com/gentoo/gentoo/pull/4868
Comment 18 Thomas Deutschmann gentoo-dev 2017-06-08 07:37:50 UTC
Now cleaned up, all done.