Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2225-1 Final 1 1 2017-08-21T13:04:15Z current 2017-08-21T13:04:15Z 2017-08-21T13:04:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git fixes the following issues: - CVE-2017-1000117: an argument injection in SSH URLs could lead to client-side code execution (bsc#1052481) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-git-13235,slestso13-git-13235 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172225-1/ Link for SUSE-SU-2017:2225-1 https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00058.html E-Mail link for SUSE-SU-2017:2225-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1052481 SUSE Bug 1052481 https://www.suse.com/security/cve/CVE-2017-1000117/ SUSE CVE CVE-2017-1000117 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 git-1.7.12.4-0.18.3.1 git-arch-1.7.12.4-0.18.3.1 git-core-1.7.12.4-0.18.3.1 git-cvs-1.7.12.4-0.18.3.1 git-daemon-1.7.12.4-0.18.3.1 git-email-1.7.12.4-0.18.3.1 git-gui-1.7.12.4-0.18.3.1 git-svn-1.7.12.4-0.18.3.1 git-web-1.7.12.4-0.18.3.1 gitk-1.7.12.4-0.18.3.1 git-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-arch-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-core-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-cvs-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-daemon-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-email-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-gui-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-svn-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-web-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gitk-1.7.12.4-0.18.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-1.7.12.4-0.18.3.1 as a component of SUSE Studio Onsite 1.3 git-core-1.7.12.4-0.18.3.1 as a component of SUSE Studio Onsite 1.3 A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. CVE-2017-1000117 SUSE Linux Enterprise Software Development Kit 11 SP4:git-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-arch-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-core-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-cvs-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-daemon-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-email-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-gui-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-svn-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-web-1.7.12.4-0.18.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gitk-1.7.12.4-0.18.3.1 SUSE Studio Onsite 1.3:git-1.7.12.4-0.18.3.1 SUSE Studio Onsite 1.3:git-core-1.7.12.4-0.18.3.1 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172225-1/ https://www.suse.com/security/cve/CVE-2017-1000117.html CVE-2017-1000117 https://bugzilla.suse.com/1052481 SUSE Bug 1052481 https://bugzilla.suse.com/1052696 SUSE Bug 1052696 https://bugzilla.suse.com/1052932 SUSE Bug 1052932 https://bugzilla.suse.com/1053364 SUSE Bug 1053364 https://bugzilla.suse.com/1053600 SUSE Bug 1053600 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 https://bugzilla.suse.com/1054653 SUSE Bug 1054653 https://bugzilla.suse.com/1058214 SUSE Bug 1058214 https://bugzilla.suse.com/1066430 SUSE Bug 1066430 https://bugzilla.suse.com/1071709 SUSE Bug 1071709