oss-security - CVE request: Two vulnerabilities in git-fastclone ruby gem

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALPTtNX+xVz+Uf=tTUMp7a+NKdUp=CYGip8a5+YcFGwZsXhJ-A@mail.gmail.com>
Date: Wed, 20 Jan 2016 11:18:39 -0800
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com, 
	Assign a CVE Identifier <cve-assign@...re.org>
Cc: Blake Burkhart <bburky@...rky.com>
Subject: CVE request: Two vulnerabilities in git-fastclone ruby gem

Blake Burkhart (@bburky) recently reported two issues to Square via their
open source bug bounty program (https://hackerone.com/square-open-source)
concerning their `git-fastclone` ruby gem.

git-fastclone is "A git command that uses reference repositories and threading
to quickly and recursively clone repositories with many nested submodules."

Homepage: https://github.com/square/git-fastclone

Download: https://rubygems.org/gems/git-fastclone

* git-fastclone permits arbitrary shell command execution from .gitmodules

  https://github.com/square/git-fastclone/pull/2

  git-fastclone before 1.0.1 uses the git URL provided without validating
  the protocol being requested, which allows for executing arbitrary code
  found in the URL (such as with the 'ext' protocol).

  This is basically the same issue as CVE-2015-7545, just in a different
  client implementation. What's policy here? Should a new CVE be assigned?

  Fixed in v1.0.1. Affects all previous versions.

* git-fastclone permits arbitrary shell command execution via shell
  metacharacter injection into variables/parameters

  https://github.com/square/git-fastclone/pull/5

  git-fastclone before 1.0.5 passes user modifiable strings directly to a shell
  command. An attacker can execute malicious commands by modifying the
  strings that are passed as arguments to "cd " and "git clone " commands in
  the library.

  No CVE has been assigned.

  Fixed in v1.0.5. Affects all previous versions.

Can CVE(s) be assigned, as needed?

Thanks,
~reed

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.