CVE-2017-14867

—

CVSS 3.0

8.8 high

EPSS

36%p98

Published

Sep 29, 2017 (Sep 29, 2017)

Modified

Jun 17, 2026

Description

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

Vendors: git-scm debian
Products: git, debian linux
Weakness: CWE-78
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (36.0%)

In the news0 stories

No ingested article mentions this CVE yet.