The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
References
| Link | Resource |
|---|---|
| https://snyk.io/vuln/SNYK-RUBY-GIT-2421270 | Exploit Patch Third Party Advisory |
| https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0 | Release Notes |
| https://github.com/ruby-git/ruby-git/pull/569 | Issue Tracking Patch |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWNJA7WPE67LJ3DJMWZ2TADHCZKWMY55/ | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html | Mailing List Third Party Advisory |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Information
Published : 2022-04-19 10:15
Updated : 2023-02-16 11:28
NVD link : CVE-2022-25648
Mitre link : CVE-2022-25648
JSON object : View
CWE
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Advertisement
Products Affected
debian
- debian_linux
fedoraproject
- extra_packages_for_enterprise_linux
- fedora
git
- git