CVE-2017-15298

Published: 14 October 2017

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
git Launchpad, Ubuntu, Debian	upstream	Released (2.16.0)
	trusty	Released (1:1.9.1-1ubuntu0.10)
	xenial	Released (1:2.7.4-0ubuntu1.6)
	zesty	Ignored (end of life)
	artful	Ignored (end of life)
	bionic	Not vulnerable (1:2.17.0-1ubuntu1)
	cosmic	Not vulnerable (1:2.17.0-1ubuntu1)
	Patches: upstream: https://git.kernel.org/pub/scm/git/git.git/commit/?id=a937b37e76

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›