CVE-2022-25648

Katalog CVE

CVSS 9.8 · Critical EPSS 4,9%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada git, fedoraproject extra packages for enterprise linux +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Rincian

Terbit di NVD

19 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

4,9% peluang dieksploitasi; lebih tinggi dari 91,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ruby-git/ruby-git/pull/569 issue tracking · patch
• https://snyk.io/vuln/SNYK-RUBY-GIT-2421270 exploit · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html mailing list · advisory pihak ketiga
• https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0 release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTJUF6SFPL4ZV...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q2V3HOFU4ZVTQ...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNJA7WPE67LJ...