CVE-2017-17831 | BDVDB-2026-94413 Detail

Description#

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1
http://blog.recurity-labs.com/2017-08-10/scm-vulns
http://www.securityfocus.com/bid/102926
https://github.com/git-lfs/git-lfs/pull/2242
https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html

Exploit#

No public exploit known

History#

Version 12017-12-21Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.