Vulnerability · NVD

CVE-2017-1000117

HIGH 8.8 Published on 2017-10-05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS 77.82% exploit likely percentile 99.5%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Git Windows winget:Git.Git

Affected — Fixed in — Latest tracked 2.55.0.3 undetermined

Vulnerable CPE configurations (51)

Vendor	Product	Platform	Versions	CPE 2.3 URI
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≤2.7.5	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.0:rc1::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.0:rc2::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.0:rc3::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.1:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.2:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.3:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.4:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.8.5:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.0:rc1::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.0:rc2::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.1:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.2:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.3:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.9.4:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.0:rc1::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.0:rc2::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.1:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.2:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.10.3:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.0:rc1::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.0:rc2::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.0:rc3::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.1:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.11.2:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.0:rc1::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.0:rc2::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.1:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.2:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.12.3:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.0:rc1::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.0:rc2::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.1:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.2:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.3:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.13.4:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.14.0:::::::*
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.14.0:rc0::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.14.0:rc1::::::

View on NVD ↗