PT-2021-14349 · Github · Git Lfs

Ry0Tak · Published 2021-01-15 · Updated 2024-03-06 · CVE-2021-21237

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Git LFS versions prior to 2.13.2

Description: The issue occurs on Windows when Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, allowing the execution of arbitrary code. This is due to the standard library behavior of exec.LookPath on Windows and the fact that Go includes and prefers the current directory when the name of a command run does not contain a directory separator. This issue does not affect Unix systems and is a result of an incomplete fix for a previous issue.

Recommendations: For versions prior to 2.13.2, update to version 2.13.2 to resolve the issue. As a temporary workaround, consider avoiding untrusted repositories or using a different operating system until the update is applied.

Fix

Code Injection

Untrusted Search Path

Weakness Enumeration

CWE-94

CWE-426

Related Identifiers

BIT-GIT-LFS-2021-21237

CVE-2021-21237

GHSA-CX3W-XQMC-84G5

GO-2021-0098

Affected Products

Git Lfs

References · 14

• https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a · Patch
• https://cve.org/CVERecord?id=CVE-2021-21237 · Security Note
• https://osv.dev/vulnerability/BIT-git-lfs-2021-21237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21237 · Security Note
• https://ubuntu.com/security/CVE-2021-21237 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cx3w-xqmc-84g5 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21237 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21237 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0098 · Vendor Advisory
• https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5 · Note
• https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2 · Note
• https://github.com/git-lfs/git-lfs · Note
• https://pkg.go.dev/vuln/GO-2021-0098 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955 · Note