Arbitrary Command Execution Affecting git-fastclone package, versions <1.0.1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-GITFASTCLONE-20351
- published 28 Mar 2017
- disclosed 11 Dec 2015
- credit Blake Burkhart
Introduced: 11 Dec 2015
CVE-2015-8968 Open this link in a new tabHow to fix?
Upgrade to version 1.0.1
or greater.
Overview
git-fastclone
is a git command that uses reference repositories and threading to quickly and recursively clone repositories with many nested submodules.
Affected version of this package are vulnerable to Arbitrary Command Execution. git-fastclone
used the git-remote-ext
command, allowing a user to specify remote URLs.
An attacker could manipulate a user to run a recursive clone from a repository they control, allowing the attacker to run arbitrary commands. This attack works when cloning both local and remote repositories.