The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-types-dataUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade rubygem-localeUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cloneUpgrade rubygem-multi_jsonUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hashieUpgrade rubygem-mime-typesUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-netrcUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade python39-pulp_manifestUpgrade satellite-cliUpgrade rubygem-unicodeUpgrade rubygem-unf | Nov 17, 2022 | Apr 19, 2022 |
| Debian | — | Upgrade ruby-git | Feb 1, 2023 | Apr 19, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cliUpgrade rubygem-http-cookieUpgrade rubygem-netrcUpgrade rubygem-little-pluggerUpgrade satellite-maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cloneUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-domain_nameUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade rubygem-ffiUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-loggingUpgrade rubygem-hashieUpgrade rubygem-jwtUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-gssapiUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-unicode-debuginfo | Nov 17, 2022 | Apr 19, 2022 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Apr 19, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub