{"thread":{"id":"45794","subject":"Git Shell Security Issues","startedAt":"2017-04-25T10:34:47Z","lastAt":"2017-04-25T10:40:57Z","messageCount":2,"participants":["Timo Schmid","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"317798","messageId":"5a5b33d8-f36f-bf94-6473-a9c2a980f65d@ernw.de","threadId":"45794","inReplyTo":null,"subject":"Git Shell Security Issues","fromName":"Timo Schmid","fromEmail":"tschmid@ernw.de","sentAt":"2017-04-25T10:29:22Z","receivedAt":"2017-04-25T10:34:47Z","isPatch":false,"sender":{"key":"tschmid@ernw.de","avatar":null},"body":"Hi,\n\nI've found a security issue in the git-shell command, which allows authenticated\nattackers to read files, partially write files and in some configurations to execute\nshell commands in the context of the remote user.\n\nShould I report the details here or is there a security mailing list which I haven't\nfound yet?\n\nThanks,\n-- \nTimo Schmid\n\nERNW GmbH, Carl-Bosch-Str. 4, 69115 Heidelberg  -  www.ernw.de\nTel. +49 6221 48039-0 (HQ) - Fax +49 6221 419008 - Cell +49 151 16227192\nPGP-FP F436 A5DE D817 E5A6 AFA0 A0A5 E04E 7BA1 EBDF B848\n\nHandelsregister Mannheim: HRB 337135\nGeschaeftsfuehrer: Enno Rey\n\n==============================================================\n|| Blog: www.insinuator.net | | Conference: www.troopers.de ||\n==============================================================\n\n"},{"id":"317799","messageId":"20170425104050.qcivu5edpzo37t7m@sigill.intra.peff.net","threadId":"45794","inReplyTo":"5a5b33d8-f36f-bf94-6473-a9c2a980f65d@ernw.de","subject":"Re: Git Shell Security Issues","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2017-04-25T10:40:50Z","receivedAt":"2017-04-25T10:40:57Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Apr 25, 2017 at 12:29:22PM +0200, Timo Schmid wrote:\n\n> I've found a security issue in the git-shell command, which allows authenticated\n> attackers to read files, partially write files and in some configurations to execute\n> shell commands in the context of the remote user.\n\nYikes.\n\n> Should I report the details here or is there a security mailing list which I haven't\n> found yet?\n\ngit-security@googlegroups.com\n\n-Peff\n"}]}