Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2717-1 Final 1 1 2017-10-12T14:32:28Z current 2017-10-12T14:32:28Z 2017-10-12T14:32:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git fixes the following issues: - CVE-2017-14867: A cvsserver perl script command injection was fixed (CVE-2017-14867, bsc#1061041): The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-git-13310,slestso13-git-13310 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172717-1/ Link for SUSE-SU-2017:2717-1 https://lists.opensuse.org/opensuse-security-announce/2017-10/msg00015.html E-Mail link for SUSE-SU-2017:2717-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1061041 SUSE Bug 1061041 https://www.suse.com/security/cve/CVE-2017-14867/ SUSE CVE CVE-2017-14867 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 git-1.7.12.4-0.18.6.1 git-arch-1.7.12.4-0.18.6.1 git-core-1.7.12.4-0.18.6.1 git-cvs-1.7.12.4-0.18.6.1 git-daemon-1.7.12.4-0.18.6.1 git-email-1.7.12.4-0.18.6.1 git-gui-1.7.12.4-0.18.6.1 git-svn-1.7.12.4-0.18.6.1 git-web-1.7.12.4-0.18.6.1 gitk-1.7.12.4-0.18.6.1 git-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-arch-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-core-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-cvs-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-daemon-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-email-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-gui-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-svn-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-web-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gitk-1.7.12.4-0.18.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 git-1.7.12.4-0.18.6.1 as a component of SUSE Studio Onsite 1.3 git-core-1.7.12.4-0.18.6.1 as a component of SUSE Studio Onsite 1.3 Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support. CVE-2017-14867 SUSE Linux Enterprise Software Development Kit 11 SP4:git-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-arch-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-core-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-cvs-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-daemon-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-email-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-gui-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-svn-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:git-web-1.7.12.4-0.18.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gitk-1.7.12.4-0.18.6.1 SUSE Studio Onsite 1.3:git-1.7.12.4-0.18.6.1 SUSE Studio Onsite 1.3:git-core-1.7.12.4-0.18.6.1 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172717-1/ https://www.suse.com/security/cve/CVE-2017-14867.html CVE-2017-14867 https://bugzilla.suse.com/1060377 SUSE Bug 1060377 https://bugzilla.suse.com/1060378 SUSE Bug 1060378 https://bugzilla.suse.com/1061041 SUSE Bug 1061041