{"id":"CVE-2017-17831","published":"2017-12-21T06:00:00Z","modified":"2024-08-05T21:06:48Z","title":"GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash…","vendor":null,"product":null,"tier":"tail","description":{"text":"GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a \"url =\" line in a .lfsconfig file within a repository.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03677,"percentile":0.8959,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1","tags":["x_refsource_MISC"]},{"url":"http://blog.recurity-labs.com/2017-08-10/scm-vulns","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/102926","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://github.com/git-lfs/git-lfs/pull/2242","tags":["x_refsource_MISC"]},{"url":"https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.9,"factors":[{"name":"EPSS percentile","points":17.92}]},"affected":[{"ecosystem":"Go","package":"github.com/git-lfs/git-lfs","vulnerableRanges":["<2.1.1-0.20170519163204-f913f5f9c7c6","<2.1.1-0.20170519163204-f913f5f9c7c6+incompatible"],"patched":["2.1.1-0.20170519163204-f913f5f9c7c6","2.1.1-0.20170519163204-f913f5f9c7c6+incompatible"],"from":["GHSA-w4xh-w33p-4v29","GO-2021-0073"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5497","exploited":false,"provenance":"source"}}