PT-2021-18236 · Cygwin · Cygwin Git
Ryotak
·
Published
2021-04-25
·
Updated
2021-06-07
·
CVE-2021-29468
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Cygwin Git versions prior to 2.31.1-2
Description:
A specially crafted repository containing symbolic links and files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The issue allows an attacker to execute code when a user checks out a repository from an untrusted source. As a mitigation measure, users should not clone or pull from repositories from untrusted sources.
Recommendations:
For versions prior to 2.31.1-2, update to Cygwin Git version 2.31.1-2 to resolve the issue.
As a temporary workaround, consider avoiding the use of
git checkout from untrusted repositories until the issue is resolved.
Restrict access to untrusted repositories to minimize the risk of exploitation.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cygwin Git