CVE-2017-8386

git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.

• http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.htmlMailing List, Third Party Advisory
• http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/
• http://www.debian.org/security/2017/dsa-3848Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/98409Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038479Third Party Advisory
• http://www.ubuntu.com/usn/USN-3287-1Exploit, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2004
• https://access.redhat.com/errata/RHSA-2017:2491
• https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/Mitigation, Third Party Advisory
• https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/
• https://security.gentoo.org/glsa/201706-04
• http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.htmlMailing List, Third Party Advisory
• http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/
• http://www.debian.org/security/2017/dsa-3848Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/98409Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038479Third Party Advisory
• http://www.ubuntu.com/usn/USN-3287-1Exploit, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2004
• https://access.redhat.com/errata/RHSA-2017:2491
• https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/Mitigation, Third Party Advisory
• https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/
• https://security.gentoo.org/glsa/201706-04

Published

Jun 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8380Buffer overflow in the "megasas_mmio_write" function in Qemu…
• CVE-2017-8381XnView Classic for Windows Version 2.40 allows user-assisted…
• CVE-2017-8382admidio 3.2.8 has CSRF in adm_program/modules/members/member…
• CVE-2017-8383Craft CMS before 2.6.2976 does not properly restrict viewing…
• CVE-2017-8384Craft CMS before 2.6.2976 allows XSS attacks because an arra…
• CVE-2017-8385Craft CMS before 2.6.2976 does not prevent modification of t…
• CVE-2017-8387STDU Viewer version 1.6.375 might allow user-assisted attack…
• CVE-2017-8388GeniXCMS 1.0.2 allows remote attackers to bypass the alertDa…
• CVE-2017-8390The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.…
• CVE-2017-8391The OS Installation Management component in CA Client Automa…
• CVE-2017-8392The Binary File Descriptor (BFD) library (aka libbfd), as di…
• CVE-2017-8393The Binary File Descriptor (BFD) library (aka libbfd), as di…