# Git Shell Security Issues

2 messages from 2017-04-25 to 2017-04-25. Participants: Timo Schmid, Jeff King.
Thread: https://gitlist.dev/t/45794

## Timo Schmid, 2017-04-25 10:29

Subject: Git Shell Security Issues
Message-ID: <5a5b33d8-f36f-bf94-6473-a9c2a980f65d@ernw.de>
URL: https://gitlist.dev/e/5a5b33d8-f36f-bf94-6473-a9c2a980f65d%40ernw.de

```
Hi,

I've found a security issue in the git-shell command, which allows authenticated
attackers to read files, partially write files and in some configurations to execute
shell commands in the context of the remote user.

Should I report the details here or is there a security mailing list which I haven't
found yet?

Thanks,
-- 
Timo Schmid

ERNW GmbH, Carl-Bosch-Str. 4, 69115 Heidelberg  -  www.ernw.de
Tel. +49 6221 48039-0 (HQ) - Fax +49 6221 419008 - Cell +49 151 16227192
PGP-FP F436 A5DE D817 E5A6 AFA0 A0A5 E04E 7BA1 EBDF B848

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

==============================================================
|| Blog: www.insinuator.net | | Conference: www.troopers.de ||
==============================================================


```

## Jeff King, 2017-04-25 10:40

Subject: Re: Git Shell Security Issues
Message-ID: <20170425104050.qcivu5edpzo37t7m@sigill.intra.peff.net>
URL: https://gitlist.dev/e/20170425104050.qcivu5edpzo37t7m%40sigill.intra.peff.net
In-Reply-To: <5a5b33d8-f36f-bf94-6473-a9c2a980f65d@ernw.de>

```
On Tue, Apr 25, 2017 at 12:29:22PM +0200, Timo Schmid wrote:

> I've found a security issue in the git-shell command, which allows authenticated
> attackers to read files, partially write files and in some configurations to execute
> shell commands in the context of the remote user.

Yikes.

> Should I report the details here or is there a security mailing list which I haven't
> found yet?

git-security@googlegroups.com

-Peff

```