CVE-2017-1000117
HighPublic exploitA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed.
Published Oct 5, 2017 · Updated Aug 7, 2026 · Also known as ALPINE-CVE-2017-1000117, DEBIAN-CVE-2017-1000117, DLA-1068-1, DSA-3934-1, SUSE-SU-2017:2225-1, SUSE-SU-2017:2320-1, UBUNTU-CVE-2017-1000117, USN-3387-1
Key Facts
Patch immediately- CVE-2017-1000117 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Git (Git-Scm), rootio-git, emacs-git (amazon) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 78% probability of exploitation in the next 30 days.
- Fixed versions are available, including emacs-git 1.7.1-9.el6_9, emacs-git 1.8.3.1-12.el7_4, emacs-git 2.13.5-1.53.amzn1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
78%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2017-1000117 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
Affected Products
264 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GitGit-Scm | 2.10.0, 2.10.0-rc0, 2.10.0-rc1, 2.10.0-rc2, 2.10.1, 2.10.2, 2.10.3, 2.11.0 | 2.7.5 |
| rootio-gitrootio | See advisory | 1:2.14.1-1 |
| emacs-gitamazon | See advisory | 2.13.5-1.53.amzn1 |
| emacs-git-elamazon | See advisory | 2.13.5-1.53.amzn1 |
| git-allamazon | See advisory | 2.13.5-1.53.amzn1 |
Patched Releases
emacs-git
1.7.1-9.el6_9, 1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1
emacs-git-el
1.7.1-9.el6_9, 1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1
fh-system-dump-tool
0:1.0.0-5.el7
fping
0:3.10-4.el7map
Git
0:1.7.1-9.el6_9, 0:1.8.3.1-12.el7_4, 1:1.7.10.4-1+wheezy5, 1:1.9.1-1ubuntu0.6, 1:2.1.4-2.1+deb8u4, 1:2.11.0-3+deb9u1, 1:2.14.1-1, 1:2.7.4-0ubuntu1.2, 1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.11.3-r0, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5, 2.13.5-1.53.amzn1, 2.13.5-3.1, 2.14.1-1, 2.14.1-r0, 2.33.0-1.3, 2.43.7-1.ph5, 2.8.6, 2.8.6-r0, 2.7.5
git-all
1.7.1-9.el6_9, 1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1
git-arch
1.7.12.4-0.18.3.1, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
git-bzr
1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1
git-core
1.7.12.4-0.18.3.1, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
git-credential-gnome-keyring
2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
git-credential-libsecret
2.33.0-1.3
git-cvs
1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-1.53.amzn1, 2.13.5-3.1, 2.33.0-1.3
git-daemon
1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-1.53.amzn1, 2.13.5-3.1, 2.33.0-1.3
git-doc
2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
git-email
1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-1.53.amzn1, 2.13.5-3.1, 2.33.0-1.3
git-extras
2.43.7-1.ph5
git-gui
1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
git-hg
1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1
git-lang
2.43.7-1.ph5
git-p4
1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1, 2.33.0-1.3
git-svn
1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-1.53.amzn1, 2.13.5-3.1, 2.33.0-1.3
git-web
1.7.12.4-0.18.3.1, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
gitk
1.7.1-9.el6_9, 1.7.12.4-0.18.3.1, 1.8.3.1-12.el7_4, 2.12.3-27.5.1, 2.12.3-5.10.1, 2.13.5-3.1, 2.33.0-1.3
gitweb
1.7.1-9.el6_9, 1.8.3.1-12.el7_4, 2.13.5-1.53.amzn1
nagios
0:4.0.8-8.el7map
Timeline
Publicly disclosed
Oct 5, 2017
Last updated
Aug 7, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
References
- advisoryhttp://marc.info/?l=git&m=150238802328673&w=2
- advisoryRHSA-2017:2484
- advisoryRHSA-2017:2485
- advisoryRHSA-2017:2491
- advisoryRHSA-2017:2674
FAQ
Common Questions.
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed.
Affected: Git (Git-Scm) versions 2.10.0, 2.10.0-rc0, 2.10.0-rc1, 2.10.0-rc2, 2.10.1, 2.10.2, 2.10.3, 2.11.0; rootio-git; emacs-git (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including emacs-git 1.7.1-9.el6_9, emacs-git 1.8.3.1-12.el7_4, emacs-git 2.13.5-1.53.amzn1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-1000117 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo