Skip to content
Fencer Intel
high 8.8

CVE-2017-1000117 in the critical feed json

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any pro…

published 9y ago modified 4mo ago also EUVD-2017-1408

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
77.8%
EPSS 77.8% chance of exploitation in 30 days, percentile 99.5%
public exploits
2
Metasploit and Exploit-DB

Summary

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

Patch / fix

  • git Debian 14, Debian 13, Debian 12 1:2.14.1-1

debian advisories DEBIAN-CVE-2017-1000117

  • git Ubuntu 14.04 LTS 1:1.9.1-1ubuntu0.6
  • git Ubuntu 16.04 LTS 1:2.7.4-0ubuntu1.2

ubuntu advisories UBUNTU-CVE-2017-1000117

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fping mobile application platform 4.5 3.10-4.el7map
  • qstat mobile application platform 4.5 2.11-13.20080912svn311.el7map
  • redis mobile application platform 4.5 2.8.21-2.el7map
  • ssmtp mobile application platform 4.5 2.64-14.el7map
  • nagios mobile application platform 4.5 4.0.8-8.el7map
  • phantomjs mobile application platform 4.5 1.9.7-3.el7map
  • sendEmail mobile application platform 4.5 1.56-2.el7
  • supervisor mobile application platform 4.5 3.1.3-3.el7map

red hat advisories RHSA-2017:2674RHSA-2017:2491RHSA-2017:2485RHSA-2017:2484

  • git SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for SAP 12 SP1 +9 more 2.12.3-27.5.1
  • git Studio Onsite 1.3, SLE Software Development Kit 11 SP4 1.7.12.4-0.18.3.1

suse advisories SUSE-SU-2017:2320-1SUSE-SU-2017:2225-1

  • git openSUSE Tumbleweed 2.33.0-1.3

opensuse advisories openSUSE-SU-2024:10786-1

  • git Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 2.14.1-r0
  • git Alpine 3.3 2.8.6-r0
  • git Alpine 3.4 2.8.6
  • git Alpine 3.5 2.11.3-r0
  • git Alpine 3.6 2.13.5

alpine advisories ALPINE-CVE-2017-1000117

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • git Arch Linux 2.14.1-1

arch linux advisories AVG-377

Is CVE-2017-1000117 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-1000117 updated cvss 6.3

git: Command injection via malicious ssh URLs

  • Red Hat Enterprise Linux Client Optional (v. 7) git 1.8.3.1-12.el7_4, gitk 1.8.3.1-12.el7_4, git-hg 1.8.3.1-12.el7_4, git-p4 1.8.3.1-12.el7_4, gitweb 1.8.3.1-12.el7_4, git-all 1.8.3.1-12.el7_4, +10 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) git 1.8.3.1-12.el7_4, gitk 1.8.3.1-12.el7_4, git-hg 1.8.3.1-12.el7_4, git-p4 1.8.3.1-12.el7_4, gitweb 1.8.3.1-12.el7_4, git-all 1.8.3.1-12.el7_4, +10 more
    fixed: vendor fix RHSA-2017:2484
  • Red Hat Enterprise Linux Desktop Optional (v. 6) git 1.7.1-9.el6_9, gitk 1.7.1-9.el6_9, gitweb 1.7.1-9.el6_9, git-all 1.7.1-9.el6_9, git-cvs 1.7.1-9.el6_9, git-gui 1.7.1-9.el6_9, +6 more Red Hat Enterprise Linux HPC Node Optional (v. 6) git 1.7.1-9.el6_9, gitk 1.7.1-9.el6_9, gitweb 1.7.1-9.el6_9, git-all 1.7.1-9.el6_9, git-cvs 1.7.1-9.el6_9, git-gui 1.7.1-9.el6_9, +6 more Red Hat Enterprise Linux Server (v. 6) git 1.7.1-9.el6_9, perl-Git 1.7.1-9.el6_9
    fixed: vendor fix RHSA-2017:2485
  • Red Hat Enterprise Linux Server (v. 7) git 1.8.3.1-12.el7_4, perl-Git 1.8.3.1-12.el7_4
    fixed: vendor fix RHSA-2017:2484
  • Red Hat Enterprise Linux Server Optional (v. 6) gitk 1.7.1-9.el6_9, gitweb 1.7.1-9.el6_9, git-all 1.7.1-9.el6_9, git-cvs 1.7.1-9.el6_9, git-gui 1.7.1-9.el6_9, git-svn 1.7.1-9.el6_9, +4 more
    fixed: vendor fix RHSA-2017:2485
  • Red Hat Enterprise Linux Server Optional (v. 7) gitk 1.8.3.1-12.el7_4, git-hg 1.8.3.1-12.el7_4, git-p4 1.8.3.1-12.el7_4, gitweb 1.8.3.1-12.el7_4, git-all 1.8.3.1-12.el7_4, git-bzr 1.8.3.1-12.el7_4, +8 more
    fixed: vendor fix RHSA-2017:2484
  • Red Hat Enterprise Linux Workstation (v. 6) git 1.7.1-9.el6_9, perl-Git 1.7.1-9.el6_9
    fixed: vendor fix RHSA-2017:2485
  • Red Hat Enterprise Linux Workstation (v. 7) git 1.8.3.1-12.el7_4, perl-Git 1.8.3.1-12.el7_4
    fixed: vendor fix RHSA-2017:2484
  • Red Hat Enterprise Linux Workstation Optional (v. 6) gitk 1.7.1-9.el6_9, gitweb 1.7.1-9.el6_9, git-all 1.7.1-9.el6_9, git-cvs 1.7.1-9.el6_9, git-gui 1.7.1-9.el6_9, git-svn 1.7.1-9.el6_9, +4 more
    fixed: vendor fix RHSA-2017:2485
show 4 more
  • Red Hat Enterprise Linux Workstation Optional (v. 7) gitk 1.8.3.1-12.el7_4, git-hg 1.8.3.1-12.el7_4, git-p4 1.8.3.1-12.el7_4, gitweb 1.8.3.1-12.el7_4, git-all 1.8.3.1-12.el7_4, git-bzr 1.8.3.1-12.el7_4, +8 more
    fixed: vendor fix RHSA-2017:2484
  • Red Hat Mobile Application Platform 4.5 fping 3.10-4.el7map, sendEmail 1.56-2.el7, ssmtp 2.64-14.el7map, nagios 4.0.8-8.el7map, redis 2.8.21-2.el7map, rhmap45/fh-aaa 1.0.5-12, +69 more
    fixed: vendor fix RHSA-2017:2674
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-git29-git 2.9.3-3.el6, rh-git29-gitk 2.9.3-3.el6, rh-git29-git-p4 2.9.3-3.el6, rh-git29-gitweb 2.9.3-3.el6, rh-git29-git-all 2.9.3-3.el6, rh-git29-git-cvs 2.9.3-3.el6, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-git29-git 2.9.3-3.el7, rh-git29-gitk 2.9.3-3.el7, rh-git29-git-p4 2.9.3-3.el7, rh-git29-gitweb 2.9.3-3.el7, rh-git29-git-all 2.9.3-3.el7, rh-git29-git-cvs 2.9.3-3.el7, +7 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-git29-git 2.9.3-3.el6, rh-git29-gitk 2.9.3-3.el6, rh-git29-git-p4 2.9.3-3.el6, rh-git29-gitweb 2.9.3-3.el6, rh-git29-git-all 2.9.3-3.el6, rh-git29-git-cvs 2.9.3-3.el6, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-git29-git 2.9.3-3.el7, rh-git29-gitk 2.9.3-3.el7, rh-git29-git-p4 2.9.3-3.el7, rh-git29-gitweb 2.9.3-3.el7, rh-git29-git-all 2.9.3-3.el7, rh-git29-git-cvs 2.9.3-3.el7, +7 more
    fixed: vendor fix RHSA-2017:2491
  • Red Hat BPM Suite 6 jgit jgit Red Hat JBoss A-MQ 6 fabric8 fabric8 Red Hat JBoss BRMS 6 jgit jgit Red Hat JBoss Data Virtualization 6 jgit jgit Red Hat JBoss Fuse 6 camel Red Hat JBoss Fuse Service Works 6 jgit jgit
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/git_submodule_command_exec)
  2. Published

Exploit prediction

77.82% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.