PT-2021-21258 · Unknown+1 · Dandavison Delta+1

Ryotak · Published 2021-07-12 · Updated 2024-06-15 · CVE-2021-36376

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dandavison delta version 0.8.2 and earlier git-delta version 0.8.2 and earlier

Description The issue arises when the software resolves an executable's pathname as a relative path from the current directory on Windows. This could potentially lead to security issues.

Recommendations For dandavison delta version 0.8.2 and earlier, update to version 0.8.3 or later to resolve the issue. For git-delta version 0.8.2 and earlier, update to version 0.8.3 or later to resolve the issue.

Fix

Relative Path Traversal

Uncontrolled Search Path Element

Weakness Enumeration

CWE-23

CWE-427

Related Identifiers

CVE-2021-36376

GHSA-5XG3-J2J6-RCX4

OPENSUSE-SU-2024:10788-1

RUSTSEC-2021-0105

Affected Products

Dandavison Delta

Git-Delta

References · 14

• https://github.com/dandavison/delta/commit/f01846bd443aaf92fdd5ac20f461beac3f6ee3fd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-36376 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10788-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xg3-j2j6-rcx4 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0105 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36376 · Vendor Advisory
• https://github.com/dandavison/delta/releases/tag/0.8.3 · Note
• https://github.com/dandavison/delta · Note
• https://crates.io/crates/git-delta · Note
• https://vuln.ryotak.me/advisories/54 · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0105.html · Note
• https://suse.com/security/cve/CVE-2021-36376 · Note
• https://t.me/cibsecurity/26104 · Telegram Post
• https://t.me/cvenotify/17769 · Telegram Post