GitHub Git LFS Arbitrary command execution vulnerability

高 8.8CVE-2017-17831 · GHSA-w4xh-w33p-4v29 · GO-2021-0073 · 21/12/2017 公開 · 17/06/2026 更新

要点

CVE-2017-17831 は github.com/git-lfs/git-lfs, git large file storage (git large file storage project) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.7%（全脆弱性の 89.7% より高い）。
対処：2.1.1-0.20170519163204-f913f5f9c7c6, 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible, 2.1.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/git-lfs/git-lfs Go	`< 2.1.1-0.20170519163204-f913f5f9c7c6< 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible`	`2.1.1-0.20170519163204-f913f5f9c7c62.1.1-0.20170519163204-f913f5f9c7c6+incompatible`
git large file storage git_large_file_storage_project	`< 2.1.1`	`2.1.1`

概要

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a url = line in a .lfsconfig file within a repository.

Specific Go Packages Affected

github.com/git-lfs/git-lfs/lfsapi

NVD の説明

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.