CVE-2018-17456: canonical ubuntu_linux Argument Injection

CVSS: 9.8v3.0CriticalModified

AliasesALPINE-CVE-2018-17456MGASA-2018-0395SUSE-SU-2018:3150-1+12 more

Published 06-10-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-17456 is a critical (CVSS 9.8) Argument Injection vulnerability in canonical ubuntu_linux. EPSS estimates a 97.36% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

97.36%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 4 · Related 4

OPENSUSE-SU-2020:0598-1 OPENSUSE-SU-2024:10786-1 OPENSUSE-SU-2024:10943-1 SUSE-SU-2020:1121-1

Timeline

06-10-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

97.36%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 97.36% on 18-09-2026

18-09-202618-10-2026

EPSS score

97.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaselocallinuxUnverified
Git Submodule - Arbitrary Code Execution
Maturity: poc
exploit-databaselocallinuxUnverified
Git Submodule - Arbitrary Code Execution (PoC)
Maturity: poc
MetasploitremoteVerified
Malicious Git HTTP Server For CVE-2018-17456
exploit/multi/http/git_submodule_url_exec
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Redhat44 products

ansible_tower3.3
enterprise_linuxEOL6.0 | 6.7 | 7.0 | 7.3 | 7.4 | 7.5 | 7.6
enterprise_linux_desktop7.0
enterprise_linux_server7.0
enterprise_linux_server_aus7.6

Show all 44

Suse19 products

git&distro=HPE Helion OpenStack 8< 2.12.3-27.17.2
git&distro=SUSE Enterprise Storage 4< 2.12.3-27.17.2
git&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.16.4-3.6.1
git&distro=SUSE Linux Enterprise Module for Development Tools 15< 2.16.4-3.6.1
git&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 2.12.3-27.17.2

Show all 19

Debian2 products

git< 1:2.19.1-1 | < 1:2.11.0-3+deb9u4 | < 1:2.1.4-2.1+deb8u7
debian_linuxEOL9.0

Alpine1 product

git≥ 2.14.0, < 2.19.1-r0 | ≥ 2.14.0, < 2.11.3-r2 | ≥ 2.14.0, < 2.13.7-r1 | ≥ 2.14.0, < 2.15.3-r0 | ≥ 2.14.0, < 2.18.1-r0

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 18.04

Git-scm1 product

git≥ 2.14.0, < 2.14.5 | ≥ 2.15.0, < 2.15.3 | ≥ 2.16.0, < 2.16.5 | ≥ 2.17.0, < 2.17.2 | ≥ 2.18.0, < 2.18.1 | ≥ 2.19.0, < 2.19.1

Mageia1 product

git< 2.13.7-1.2.mga6

Ubuntu1 product

git< 1:1.9.1-1ubuntu0.9 | < 1:2.7.4-0ubuntu1.5 | < 1:2.17.1-1ubuntu0.3

8 vendors · 70 products

References

41 links

www.exploit-db.com/exploits/45631/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/105523VDB EntryX Refsource BIDThird Party Advisory
www.securitytracker.com/id/1041811VDB EntryX Refsource SECTRACKThird Party Advisory
www.debian.org/security/2018/dsa-4311Vendor AdvisoryX Refsource DEBIANThird Party Advisory
access.redhat.com/errata/RHSA-2018:3505Vendor AdvisoryX Refsource REDHATThird Party Advisory
github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404X Refsource MISCPatchThird Party Advisory
www.exploit-db.com/exploits/45548/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:3541Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46X Refsource MISCPatchThird Party Advisory
access.redhat.com/errata/RHSA-2018:3408Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory

Show all 41 references

marc.info?l=git&m=153875888916397&w=2X Refsource MISCThird Party Advisory
www.openwall.com/lists/oss-security/2018/10/06/3X Refsource MISCMailing ListThird Party Advisory
usn.ubuntu.com/3791-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
seclists.org/bugtraq/2019/Mar/30Mailing ListX Refsource BUGTRAQThird Party Advisory
www.securityfocus.com/bid/107511VDB EntryX Refsource BIDThird Party Advisory
packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.htmlX Refsource MISCThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2020:0316Vendor AdvisoryX Refsource REDHATAdvisory
lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlVendor AdvisoryX Refsource SUSE
security.alpinelinux.org/vuln/CVE-2018-17456Advisory
advisories.mageia.org/MGASA-2018-0395.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=23642REPORT
www.suse.com/support/update/announcement/2018/suse-su-20183150-1/Advisory
bugzilla.suse.com/1110949REPORT
www.suse.com/security/cve/CVE-2018-17456WEB
www.suse.com/support/update/announcement/2018/suse-su-20184009-1/Advisory
bugzilla.suse.com/1114729REPORT
www.suse.com/support/update/announcement/2018/suse-su-20184088-1/Advisory
www.suse.com/support/update/announcement/2018/suse-su-20184088-2/Advisory
www.suse.com/support/update/announcement/2018/suse-su-20184088-3/Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1636619REPORT
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3408.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-17456REPORT
www.cve.org/CVERecord?id=CVE-2018-17456AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-17456Advisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3541.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0316.jsonAdvisory
ubuntu.com/security/CVE-2018-17456REPORT
public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct.c.googlers.com/REPORT
ubuntu.com/security/notices/USN-3791-1Advisory
security-tracker.debian.org/tracker/CVE-2018-17456Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities