PT-2022-8885 · Unknown · Git-Archive

Published 2022-07-25 · Updated 2022-08-01 · CVE-2020-28422

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions git-archive versions all

Description The issue concerns Command Injection via the exports function. This allows for potential execution of arbitrary commands.

Recommendations For all versions, consider disabling the exports function as a temporary workaround until a patch is available. Restrict access to the exports function to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-28422

GHSA-VQGR-MFXM-47F3

Affected Products

Git-Archive

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-28422 · Security Note
• https://osv.dev/vulnerability/GHSA-vqgr-mfxm-47f3 · Vendor Advisory
• https://t.me/cvenotify/34102 · Telegram Post
• https://t.me/cibsecurity/46932 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-GITARCHIVE-1050391 · Note