SUSE-SU-2017:2320-1

HIGH8.5

Security update for git

Published Aug 31, 2017

Modified 8 years ago

Fix available

Details

Description of the patch:

This update for git fixes the following issues:

CVE-2017-1000117: A client side code execution via shell injection when receiving special submodule strings from a malicious server was fixed (bsc#1052481)

Affected Packages(11 packages)

git-core

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12 SP2SUSE Linux Enterprise Server 12 SP3SUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for Raspberry Pi 12 SP2

Fixed in:

2.12.3-27.5.1

git-doc

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12 SP2SUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for Raspberry Pi 12 SP2SUSE Linux Enterprise Server for SAP Applications 12

Fixed in:

2.12.3-27.5.1

git

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-arch

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-cvs

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-daemon

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-email

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-gui

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-svn

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

git-web

SUSE Linux Enterprise Software Development Kit 12 SP2SUSE Linux Enterprise Software Development Kit 12 SP3

Fixed in:

2.12.3-27.5.1

References

https://bugzilla.suse.com/1052481

https://lists.suse.com/pipermail/sle-security-updates/2017-August/003178.html

https://www.suse.com/security/cve/CVE-2017-1000117/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2017/suse-su-20172320-1/

CVSS Analysis

CVSS v3.0

8.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Upstream

CVE-2017-1000117

Ecosystems(12)

SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for Raspberry Pi 12 SP2

Timeline

PublishedAug 31, 2017

ModifiedAug 31, 2017

SUSE-SU-2017:2320-1 | Mondoo Vulnerability Intelligence