A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "2.7.5"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.0-rc3"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.3"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.4"
},
{
"introduced": "0"
},
{
"last_affected": "2.8.5"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.3"
},
{
"introduced": "0"
},
{
"last_affected": "2.9.4"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.10.3"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.0-rc3"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.11.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.12.3"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.3"
},
{
"introduced": "0"
},
{
"last_affected": "2.13.4"
},
{
"introduced": "0"
},
{
"last_affected": "2.14.0"
},
{
"introduced": "0"
},
{
"last_affected": "2.14.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "2.14.0-rc1"
}
]
}