git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Git Shell Security Issues

From
Jeff King <peff@peff.net>
Date
Apr 25, 2017, 10:40 UTC
Message-ID
<20170425104050.qcivu5edpzo37t7m@sigill.intra.peff.net>
In-Reply-To
<5a5b33d8-f36f-bf94-6473-a9c2a980f65d@ernw.de>
On Tue, Apr 25, 2017 at 12:29:22PM +0200, Timo Schmid wrote:
> I've found a security issue in the git-shell command, which allows authenticated
> attackers to read files, partially write files and in some configurations to execute
> shell commands in the context of the remote user.
Yikes.
> Should I report the details here or is there a security mailing list which I haven't
> found yet?
git-security@googlegroups.com
-Peff
Previous: Timo Schmid
Message 2 of 2 in “Git Shell Security Issues”
  1. Timo SchmidApr 25, 2017
  2. Jeff KingApr 25, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.