CVE-2017-8386 漏洞信息： Amazon Linux Security Advisory for git: ALAS-2017-842

Escape out of git-shell
A flaw was found in the way git-shell handled command-line options for the restricted set of git-shell commands. A remote authenticated attacker could use this flaw to bypass git-shell restrictions, to view and manipulate files, by abusing the instance of the less command launched using crafted command-line options. (CVE-2017-8386 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-842 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-842: Amazon Linux (git (2.7.5-1.49.amzn1) on noarch)

ALAS-2017-842: Amazon Linux (git (2.7.5-1.49.amzn1) on x86_64)

ALAS-2017-842: Amazon Linux (git (2.7.5-1.49.amzn1) on src)

ALAS-2017-842: Amazon Linux (git (2.7.5-1.49.amzn1) on i686)