Gentoo Logo

git: Multiple vulnerabilties


1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200903-15 / git
Release Date March 09, 2009
Latest Revision March 09, 2009: 01
Impact high
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
dev-util/git < >= All supported architectures

Related bugreports: #251343


Multiple vulnerabilities in gitweb allow for remote execution of arbitrary commands.

2.  Impact Information


GIT - the stupid content tracker, the revision control system used by the Linux kernel team.


Multiple vulnerabilities have been reported in gitweb that is part of the git package:

  • Shell metacharacters related to git_search are not properly sanitized (CVE-2008-5516).
  • Shell metacharacters related to git_snapshot and git_object are not properly sanitized (CVE-2008-5517).
  • The diff.external configuration variable as set in a repository can be executed by gitweb (CVE-2008-5916).


A remote unauthenticated attacker can execute arbitrary commands via shell metacharacters in a query, remote attackers with write access to a git repository configuration can execute arbitrary commands with the privileges of the user running gitweb by modifying the diff.external configuration variable in the repository and sending a crafted query to gitweb.

3.  Resolution Information


There is no known workaround at this time.


All git users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/git-"

4.  References


Page updated March 09, 2009

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2015 Gentoo Foundation, Inc. Questions, Comments? Contact us.