CVE-2015-8968 | BDVDB-2026-79115 Detail

git-fastclone ruby gem All versions before 1.0.1

Description#

git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://hackerone.com/reports/104465
http://www.securityfocus.com/bid/81433
https://github.com/square/git-fastclone/pull/2

Exploit#

No public exploit known

History#

Version 12016-11-03Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.