CVE-2008-5916 [Medium] | Security Vulnerability in Git

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2023-03-07	1.55%	0.06%	-1.48%
2	2022-02-04	—	1.55%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2023-03-07

1.55%

0.06%

-1.48%

2022-02-04

—

1.55%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.6	2.0	MEDIUM	`AV:L/AC:L/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	3.9	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.6

2.0

MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:L): Requires local access to the target system.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

3.9

6.4

[email protected]

OS Trackers for CVE-2008-5916

vendor	priority	summary	link
`gentoo`	high	CVE-2008-5916: 1 GLSA(s) (200903-15), 1 atom(s) (dev-util/git); latest impact high.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2008-5916
`redhat`	—	—	https://access.redhat.com/security/cve/CVE-2008-5916
`ubuntu`	medium	CVE-2008-5916 medium priority: Ubuntu including 1 source packages (git-core), 5 status rows across 5 suites (dapper, gutsy, hardy, intrepid, upstream): released 3, not-affected 2.	https://ubuntu.com/security/CVE-2008-5916

Affected software / configurations for CVE-2008-5916

Vendor	Product	Version	Raw CPE
git	git	1.4.3.1	cpe:2.3:a:git:git:1.4.3.1:::::::*
git	git	1.4.3.2	cpe:2.3:a:git:git:1.4.3.2:::::::*
git	git	1.4.3.3	cpe:2.3:a:git:git:1.4.3.3:::::::*
git	git	1.4.3.4	cpe:2.3:a:git:git:1.4.3.4:::::::*
git	git	1.4.3.5	cpe:2.3:a:git:git:1.4.3.5:::::::*
git	git	1.4.4	cpe:2.3:a:git:git:1.4.4:::::::*
git	git	1.4.4.1	cpe:2.3:a:git:git:1.4.4.1:::::::*
git	git	1.4.4.2	cpe:2.3:a:git:git:1.4.4.2:::::::*
git	git	1.4.4.3	cpe:2.3:a:git:git:1.4.4.3:::::::*
git	git	1.4.4.4	cpe:2.3:a:git:git:1.4.4.4:::::::*
git	git	1.5.0	cpe:2.3:a:git:git:1.5.0:::::::*
git	git	1.5.0	cpe:2.3:a:git:git:1.5.0:rc2::::::
git	git	1.5.0	cpe:2.3:a:git:git:1.5.0:rc3::::::
git	git	1.5.0	cpe:2.3:a:git:git:1.5.0:rc4::::::
git	git	1.5.0.1	cpe:2.3:a:git:git:1.5.0.1:::::::*
git	git	1.5.0.2	cpe:2.3:a:git:git:1.5.0.2:::::::*
git	git	1.5.0.3	cpe:2.3:a:git:git:1.5.0.3:::::::*
git	git	1.5.0.4	cpe:2.3:a:git:git:1.5.0.4:::::::*
git	git	1.5.0.5	cpe:2.3:a:git:git:1.5.0.5:::::::*
git	git	1.5.0.6	cpe:2.3:a:git:git:1.5.0.6:::::::*
git	git	1.5.0.7	cpe:2.3:a:git:git:1.5.0.7:::::::*
git	git	1.5.1	cpe:2.3:a:git:git:1.5.1:::::::*
git	git	1.5.1.1	cpe:2.3:a:git:git:1.5.1.1:::::::*
git	git	1.5.1.2	cpe:2.3:a:git:git:1.5.1.2:::::::*
git	git	1.5.1.3	cpe:2.3:a:git:git:1.5.1.3:::::::*
git	git	1.5.1.4	cpe:2.3:a:git:git:1.5.1.4:::::::*
git	git	1.5.1.5	cpe:2.3:a:git:git:1.5.1.5:::::::*
git	git	1.5.1.6	cpe:2.3:a:git:git:1.5.1.6:::::::*
git	git	1.5.2	cpe:2.3:a:git:git:1.5.2:::::::*
git	git	1.5.2.1	cpe:2.3:a:git:git:1.5.2.1:::::::*
git	git	1.5.2.2	cpe:2.3:a:git:git:1.5.2.2:::::::*
git	git	1.5.2.3	cpe:2.3:a:git:git:1.5.2.3:::::::*
git	git	1.5.2.4	cpe:2.3:a:git:git:1.5.2.4:::::::*
git	git	1.5.2.5	cpe:2.3:a:git:git:1.5.2.5:::::::*
git	git	1.5.3	cpe:2.3:a:git:git:1.5.3:::::::*
git	git	1.5.3	cpe:2.3:a:git:git:1.5.3:rc4::::::
git	git	1.5.3	cpe:2.3:a:git:git:1.5.3:rc5::::::
git	git	1.5.3	cpe:2.3:a:git:git:1.5.3:rc7::::::
git	git	1.5.3.1	cpe:2.3:a:git:git:1.5.3.1:::::::*
git	git	1.5.3.2	cpe:2.3:a:git:git:1.5.3.2:::::::*
git	git	1.5.3.3	cpe:2.3:a:git:git:1.5.3.3:::::::*
git	git	1.5.3.4	cpe:2.3:a:git:git:1.5.3.4:::::::*
git	git	1.5.3.5	cpe:2.3:a:git:git:1.5.3.5:::::::*
git	git	1.5.3.6	cpe:2.3:a:git:git:1.5.3.6:::::::*
git	git	1.5.3.7	cpe:2.3:a:git:git:1.5.3.7:::::::*
git	git	1.5.3.8	cpe:2.3:a:git:git:1.5.3.8:::::::*
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:::::::*
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc0::::::
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc1::::::
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc1.1136.g2794::::::
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc2::::::
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc3::::::
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc4::::::
git	git	1.5.4	cpe:2.3:a:git:git:1.5.4:rc5::::::
git	git	1.5.4.1	cpe:2.3:a:git:git:1.5.4.1:::::::*
git	git	1.5.4.2	cpe:2.3:a:git:git:1.5.4.2:::::::*
git	git	1.5.4.3	cpe:2.3:a:git:git:1.5.4.3:::::::*
git	git	1.5.4.4	cpe:2.3:a:git:git:1.5.4.4:::::::*
git	git	1.5.4.5	cpe:2.3:a:git:git:1.5.4.5:::::::*
git	git	1.5.4.6	cpe:2.3:a:git:git:1.5.4.6:::::::*
git	git	1.5.5	cpe:2.3:a:git:git:1.5.5:::::::*
git	git	1.5.5	cpe:2.3:a:git:git:1.5.5:rc1::::::
git	git	1.5.5	cpe:2.3:a:git:git:1.5.5:rc2::::::
git	git	1.5.5	cpe:2.3:a:git:git:1.5.5:rc3::::::
git	git	1.5.5.1	cpe:2.3:a:git:git:1.5.5.1:::::::*
git	git	1.5.5.2	cpe:2.3:a:git:git:1.5.5.2:::::::*
git	git	1.5.5.3	cpe:2.3:a:git:git:1.5.5.3:::::::*
git	git	1.5.5.3	cpe:2.3:a:git:git:1.5.5.3:r1::::::
git	git	1.5.5.4	cpe:2.3:a:git:git:1.5.5.4:::::::*
git	git	1.5.5.5	cpe:2.3:a:git:git:1.5.5.5:::::::*
git	git	1.5.6	cpe:2.3:a:git:git:1.5.6:::::::*
git	git	1.5.6.1	cpe:2.3:a:git:git:1.5.6.1:::::::*
git	git	1.5.6.2	cpe:2.3:a:git:git:1.5.6.2:::::::*
git	git	1.5.6.3	cpe:2.3:a:git:git:1.5.6.3:::::::*
git	git	1.5.6.4	cpe:2.3:a:git:git:1.5.6.4:::::::*
git	git	1.5.6.5	cpe:2.3:a:git:git:1.5.6.5:::::::*
git	git	1.6.0	cpe:2.3:a:git:git:1.6.0:::::::*
git	git	1.6.0	cpe:2.3:a:git:git:1.6.0:rc1::::::
git	git	1.6.0	cpe:2.3:a:git:git:1.6.0:rc2::::::
git	git	1.6.0	cpe:2.3:a:git:git:1.6.0:rc3::::::

References for CVE-2008-5916

URL	Tags
http://marc.info/?l=git&m=122975564100860&w=2
http://marc.info/?l=linux-kernel&m=122975564100863&w=2:
http://osvdb.org/50918
http://secunia.com/advisories/33282
http://secunia.com/advisories/33964
http://secunia.com/advisories/34194
http://securityreason.com/securityalert/4922
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
http://www.openwall.com/lists/oss-security/2009/01/15/2
http://www.openwall.com/lists/oss-security/2009/01/20/2
http://www.ubuntu.com/usn/USN-723-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/47528
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01169.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01170.html

URL

CVE-2008-5916

Exploit prediction scoring system (EPSS) score for CVE-2008-5916

Common vulnerability scoring system (CVSS) metrics for CVE-2008-5916

Weakness enumeration for CVE-2008-5916

OS Trackers for CVE-2008-5916

Affected software / configurations for CVE-2008-5916

References for CVE-2008-5916