Strix
26.1K

CVE-2017-1000117

UnknownEPSS 77.82%

Last modified

CVE-2017-1000117 is a vulnerability of currently unknown severity. A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.. EPSS estimates a 77.82% chance of exploitation in the next 30 days.

Description

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

Metrics

EPSS Probability
77.82%

99.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Git-ScmGit<= 2.7.5
Git-ScmGit2.8.0
Git-ScmGit2.8.1
Git-ScmGit2.8.2
Git-ScmGit2.8.3
Git-ScmGit2.8.4
Git-ScmGit2.8.5
Git-ScmGit2.9.0
Git-ScmGit2.9.1
Git-ScmGit2.9.2
Git-ScmGit2.9.3
Git-ScmGit2.9.4
Git-ScmGit2.10.0
Git-ScmGit2.10.1
Git-ScmGit2.10.2
Git-ScmGit2.10.3
Git-ScmGit2.11.0
Git-ScmGit2.11.1
Git-ScmGit2.11.2
Git-ScmGit2.12.0
Git-ScmGit2.12.1
Git-ScmGit2.12.2
Git-ScmGit2.12.3
Git-ScmGit2.13.0
Git-ScmGit2.13.1
Git-ScmGit2.13.2
Git-ScmGit2.13.3
Git-ScmGit2.13.4
Git-ScmGit2.14.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-1000117?
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
How severe is CVE-2017-1000117?
Severity scoring for CVE-2017-1000117 is pending analysis. The EPSS model estimates a 77.82% probability of exploitation in the next 30 days.
How do I fix CVE-2017-1000117?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-1000117?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST