6 ms·
I disagree. DOS should probably not be "high" but this has a non-imaginary arbitrary code execution. If this is not "medium", what would be a "medium" for Git?
by remram 5y ago
I disagree. DOS should probably not be "high" but this has a non-imaginary arbitrary code execution. If this is not "medium", what would be a "medium" for Git? Any remote code execution should definitely be "high".
- junon 5y agoAnd by definition these days, almost every exploit is remotely exploitable under the right conditions. We put everything in front of a network gateway nowadays.
- remram 5y agoA lot of them are remotely exploitable but most are information disclosures or DoS vectors, which don't always need to be "high". Remote code execution, definitely "high".
- junon 5y agoA vulnerability that requires very specific, very uncommon setup is of course still a vulnerability, but not a high risk one. The setup described in this exploit is wildly uncommon - possible, but uncommon. That's more my point.