Date: Wed, 20 Jan 2016 11:18:39 -0800 From: Reed Loden <reed@...dloden.com> To: oss-security@...ts.openwall.com, Assign a CVE Identifier <cve-assign@...re.org> Cc: Blake Burkhart <bburky@...rky.com> Subject: CVE request: Two vulnerabilities in git-fastclone ruby gem Blake Burkhart (@bburky) recently reported two issues to Square via their open source bug bounty program (https://hackerone.com/square-open-source) concerning their `git-fastclone` ruby gem. git-fastclone is "A git command that uses reference repositories and threading to quickly and recursively clone repositories with many nested submodules." Homepage: https://github.com/square/git-fastclone Download: https://rubygems.org/gems/git-fastclone * git-fastclone permits arbitrary shell command execution from .gitmodules https://github.com/square/git-fastclone/pull/2 git-fastclone before 1.0.1 uses the git URL provided without validating the protocol being requested, which allows for executing arbitrary code found in the URL (such as with the 'ext' protocol). This is basically the same issue as CVE-2015-7545, just in a different client implementation. What's policy here? Should a new CVE be assigned? Fixed in v1.0.1. Affects all previous versions. * git-fastclone permits arbitrary shell command execution via shell metacharacter injection into variables/parameters https://github.com/square/git-fastclone/pull/5 git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library. No CVE has been assigned. Fixed in v1.0.5. Affects all previous versions. Can CVE(s) be assigned, as needed? Thanks, ~reed
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.