Vulnerability Description
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Git Project | Git | <= 2.3.9 |
| Redhat | Software Collections | 1.0 |
| Canonical | Ubuntu Linux | 12.04 |
| Opensuse | Opensuse | 13.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html
- http://rhn.redhat.com/errata/RHSA-2015-2515.html
- http://www.debian.org/security/2016/dsa-3435
- http://www.openwall.com/lists/oss-security/2015/12/08/5
- http://www.openwall.com/lists/oss-security/2015/12/09/8
- http://www.openwall.com/lists/oss-security/2015/12/11/7
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.h
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.h
- http://www.securityfocus.com/bid/78711
- http://www.securitytracker.com/id/1034501
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slack
- http://www.ubuntu.com/usn/USN-2835-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1269794
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txtPatchVendor Advisory
FAQ
What is CVE-2015-7545?
CVE-2015-7545 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed proto...
How severe is CVE-2015-7545?
CVE-2015-7545 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2015-7545?
Check the references section above for vendor advisories and patch information. Affected products include: Git Project Git, Redhat Software Collections, Canonical Ubuntu Linux, Opensuse Opensuse.