CVE-2017-17831

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.recurity-labs.com/2017-08-10/scm-vulnsExploit, Third Party Advisory
http://www.securityfocus.com/bid/102926Third Party Advisory, VDB Entry
https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlThird Party Advisory
https://github.com/git-lfs/git-lfs/pull/2242Patch, Third Party Advisory
https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1Release Notes, Third Party Advisory
http://blog.recurity-labs.com/2017-08-10/scm-vulnsExploit, Third Party Advisory
http://www.securityfocus.com/bid/102926Third Party Advisory, VDB Entry
https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlThird Party Advisory
https://github.com/git-lfs/git-lfs/pull/2242Patch, Third Party Advisory
https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1Release Notes, Third Party Advisory

Timeline

Published: Dec 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-178325.4ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanit CVE-2017-178339.8OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-se CVE-2017-178358.8In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.CVE-2017-178369.8In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used CVE-2017-178376.1The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off aft CVE-2017-17845.5IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local use CVE-2017-178407.8An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code b CVE-2017-178415.9Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalPr CVE-2017-178435.9An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, becau CVE-2017-178446.5An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that th CVE-2017-178457.3An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy priv CVE-2017-178467.5An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match ar