http://marc.info/?l=git&m=150238802328673&w=2A malicious third-party can give a crafted "ssh://..." URL to an
unsuspecting victim, and an attempt to visit the URL can result in
any program that exists on the victim's machine being executed.
Such a URL could be placed in the .gitmodules file of a malicious
project, and an unsuspecting victim could be tricked into running
"git clone --recurse-submodules" to trigger the vulnerability.
Information, contacts and source code for ports to Linux, Windows, etc.
1 post • Page 1 of 1