CVE-2022-25648

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Link	Resource
https://snyk.io/vuln/SNYK-RUBY-GIT-2421270	Exploit Patch
https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0	Release Notes
https://github.com/ruby-git/ruby-git/pull/569	Issue Tracking Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWNJA7WPE67LJ3DJMWZ2TADHCZKWMY55/	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:git:git:*:*:*:*:*:ruby:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

---

Published : 2022-04-19 05:15

Updated : 2023-02-16 07:28

---

NVD link : CVE-2022-25648

Mitre link : CVE-2022-25648

Extra Packages For Enterprise Linux

Fedoraproject

CWE-88