Remote Code Execution (RCE)

2023-05-1217:58:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

git

vulnerability

remote code execution

config.c

git_config_copy_or_rename_section_in_file

malicious config

0.004 Low

EPSS

Percentile

75.0%

JSON

Git is vulnerable to Remote Code Execution (RCE). The vulnerability exists in the config.c::git_config_copy_or_rename_section_in_file() function, allowing an attacker to inject and execute malicious config to $GIT_DIR/config when attempting to remove the configuration section associated with that submodule which specifies executables to run such as core.pager, core.editor, core.sshCommand commands through the URLs that are longer than 1024 characters.

CPENameOperatorVersion
git:3.14eq2.32.5-r0
git:3.14eq2.32.1-r0
git:3.14eq2.32.2-r0
git:3.14eq2.31.1-r1
git:3.14eq2.32.6-r0
git:3.14eq2.32.4-r0
git:3.14eq2.32.0-r0
git:3.14eq2.32.3-r0
git:3.18eq2.40.0-r1
git:edgeeq2.40.0-r0

Name	Operator	Version
git:3.14	eq	2.32.5-r0
git:3.14	eq	2.32.1-r0
git:3.14	eq	2.32.2-r0
git:3.14	eq	2.31.1-r1
git:3.14	eq	2.32.6-r0
git:3.14	eq	2.32.4-r0
git:3.14	eq	2.32.0-r0
git:3.14	eq	2.32.3-r0
git:3.18	eq	2.40.0-r1
git:edge	eq	2.40.0-r0