Search criteria

9 vulnerabilities found for git by git_project

FKIE_CVE-2021-23632

Vulnerability from fkie_nvd - Published: 2022-03-17 12:15 - Updated: 2024-11-21 05:51
Severity ?
6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work.
References
report@snyk.iohttps://snyk.io/vuln/SNYK-JS-GIT-1568518Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JS-GIT-1568518Exploit, Third Party Advisory
Impacted products
Vendor Product Version
git_project git *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:git_project:git:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "74AD340A-AE3C-4147-A9F3-92B843F243B7",
              "versionEndIncluding": "0.1.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require(\"git\").Git; var repo = new Git(\"repo-test\"); var user_input = \"version; date\"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work."
    },
    {
      "lang": "es",
      "value": "Todas las versiones del paquete git son vulnerables a Una Ejecuci\u00f3n de C\u00f3digo Remota (RCE) debido a una falta de saneo en el m\u00e9todo Git.git, que permite una ejecuci\u00f3n de comandos del Sistema Operativo en lugar de s\u00f3lo comandos de git. Pasos para reproducirlo 1. Crear un archivo llamado exploit.js con el siguiente contenido: js var Git = require(\"git\").Git; var repo = new Git(\"repo-test\"); var user_input = \"version; date\"; repo.git(user_input, function(err, result) { console.log(result); }) 2. En el mismo directorio que exploit.js, ejecutar npm install git. 3. Ejecuta exploit.js: node exploit.js. Deber\u00edas ver las salidas de las l\u00edneas de comandos de git version y date. Ten en cuenta que el repositorio Git repo-test no necesita estar presente para que este PoC funcione"
    }
  ],
  "id": "CVE-2021-23632",
  "lastModified": "2024-11-21T05:51:51.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 5.9,
        "source": "report@snyk.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-17T12:15:07.680",
  "references": [
    {
      "source": "report@snyk.io",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
    }
  ],
  "sourceIdentifier": "report@snyk.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2015-7545

Vulnerability from fkie_nvd - Published: 2016-04-13 15:59 - Updated: 2025-04-12 10:46
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
References
secalert@redhat.comhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2515.html
secalert@redhat.comhttp://www.debian.org/security/2016/dsa-3435
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2015/12/08/5
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2015/12/09/8
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2015/12/11/7
secalert@redhat.comhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
secalert@redhat.comhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
secalert@redhat.comhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
secalert@redhat.comhttp://www.securityfocus.com/bid/78711
secalert@redhat.comhttp://www.securitytracker.com/id/1034501
secalert@redhat.comhttp://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-2835-1
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1269794
secalert@redhat.comhttps://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txtPatch, Vendor Advisory
secalert@redhat.comhttps://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txtPatch, Vendor Advisory
secalert@redhat.comhttps://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txtPatch, Vendor Advisory
secalert@redhat.comhttps://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt
secalert@redhat.comhttps://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021
secalert@redhat.comhttps://lkml.org/lkml/2015/10/5/683
secalert@redhat.comhttps://security.gentoo.org/glsa/201605-01
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2515.html
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3435
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2015/12/08/5
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2015/12/09/8
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2015/12/11/7
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/78711
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034501
af854a3a-2127-422b-91ae-364da2661108http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2835-1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1269794
af854a3a-2127-422b-91ae-364da2661108https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txtPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txtPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txtPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt
af854a3a-2127-422b-91ae-364da2661108https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021
af854a3a-2127-422b-91ae-364da2661108https://lkml.org/lkml/2015/10/5/683
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201605-01
Impacted products
Vendor Product Version
git_project git *
git_project git 2.4.0
git_project git 2.4.1
git_project git 2.4.2
git_project git 2.4.3
git_project git 2.4.4
git_project git 2.4.5
git_project git 2.4.6
git_project git 2.4.7
git_project git 2.4.8
git_project git 2.4.9
git_project git 2.5.0
git_project git 2.5.1
git_project git 2.5.2
git_project git 2.5.3
git_project git 2.6.0
redhat software_collections 1.0
canonical ubuntu_linux 12.04
canonical ubuntu_linux 14.04
canonical ubuntu_linux 15.04
canonical ubuntu_linux 15.10
opensuse opensuse 13.1
opensuse opensuse 13.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:git_project:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE0D05BB-1BFE-4BB9-A701-05F3E0109F85",
              "versionEndIncluding": "2.3.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "721C0D3E-F214-4347-896A-3F1866286029",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDC97E73-FE7D-40DD-BA8B-71E3CE3E5C6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2A0F218-26C6-444F-854C-2264B24D029C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "65B4AE0E-5020-427B-9625-1EA3AC54ABD9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5766EF06-BEC1-4FD9-8F29-68324A7B94A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAA8483A-8404-4237-B306-BAE83980BD10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "F871DDC6-BE12-41E5-A088-3FDC7F62D959",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E0F1049-E958-4453-B259-36A99167C3BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD2F404D-42FA-4F57-A046-2DDEDACADC93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D16372D-7870-4F33-B53F-DEAF689EEE1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F50C530F-6122-4E70-A718-3ACFFF18BC81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B6048B6-9CAE-4B2C-AC69-8374DDA97A15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "007EBCB7-19E7-46D9-8842-65F36CA7C0C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E414B6E-2783-4E96-B15B-1971E4C78EDC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git_project:git:2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C57363C-6D6C-41F3-9D69-E38DDAE7C05B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D7EE4B6-A6EC-4B9B-91DF-79615796673F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "E88A537F-F4D0-46B9-9E37-965233C2A355",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule."
    },
    {
      "lang": "es",
      "value": "El (1) git-remote-ext y (2) otros programas de ayuda remotos no especificados en Git en versiones anteriores a 2.3.10, 2.4.x en versiones anteriores a 2.4.10, 2.5.x en versiones anteriores a 2.5.4 y 2.6.x en versiones anteriores a 2.6.1 no restringen correctamente los protocolos permitidos, lo que podr\u00eda permitir a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de una URL en un (a) archivo .gitmodules u (b) otras fuentes desconocidas en un subm\u00f3dulo."
    }
  ],
  "id": "CVE-2015-7545",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-04-13T15:59:01.320",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2016/dsa-3435"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/78711"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id/1034501"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-2835-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lkml.org/lkml/2015/10/5/683"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://security.gentoo.org/glsa/201605-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2016/dsa-3435"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/78711"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1034501"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2835-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lkml.org/lkml/2015/10/5/683"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201605-01"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2015-7082

Vulnerability from fkie_nvd - Published: 2015-12-11 11:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode use cases.
References
product-security@apple.comhttp://lists.apple.com/archives/security-announce/2015/Dec/msg00004.htmlVendor Advisory
product-security@apple.comhttp://www.securitytracker.com/id/1034340
product-security@apple.comhttps://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txtVendor Advisory
product-security@apple.comhttps://support.apple.com/HT205642Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034340
af854a3a-2127-422b-91ae-364da2661108https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT205642Vendor Advisory
Impacted products
Vendor Product Version
git_project git *
apple xcode 7.1.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:git_project:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9910B35C-DE40-4270-A193-50844053A3C2",
              "versionEndIncluding": "2.5.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:xcode:7.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "327FAAD8-541A-4CC1-8468-A826906AF635",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors.  NOTE: this CVE is associated only with Xcode use cases."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades no especificadas en Git en versiones anteriores a 2.5.4, como se utiliza en Apple Xcode en versiones anteriores a 7.2, tienen impacto y vectores de ataque desconocidos. NOTA: \u00e9sta CVE esta asociada solo con casos de uso Xcode."
    }
  ],
  "id": "CVE-2015-7082",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-12-11T11:59:47.580",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securitytracker.com/id/1034340"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT205642"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1034340"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT205642"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-23632 (GCVE-0-2021-23632)

Vulnerability from cvelistv5 – Published: 2022-03-17 11:20 – Updated: 2024-09-16 17:38
VLAI?
Summary
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work.
Severity ?
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • Remote Code Execution (RCE)
Assigner
References
Impacted products
Vendor Product Version
n/a git Affected: 0 , < unspecified (custom)
Credits
Paul-Emmanuel Raoul of SkypLabs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:08.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Paul-Emmanuel Raoul of SkypLabs"
        }
      ],
      "datePublic": "2022-03-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require(\"git\").Git; var repo = new Git(\"repo-test\"); var user_input = \"version; date\"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution (RCE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-17T11:20:22",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
        }
      ],
      "title": "Remote Code Execution (RCE)",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2022-03-17T11:16:18.518275Z",
          "ID": "CVE-2021-23632",
          "STATE": "PUBLIC",
          "TITLE": "Remote Code Execution (RCE)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "git",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Paul-Emmanuel Raoul of SkypLabs"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require(\"git\").Git; var repo = new Git(\"repo-test\"); var user_input = \"version; date\"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution (RCE)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-GIT-1568518",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23632",
    "datePublished": "2022-03-17T11:20:22.259001Z",
    "dateReserved": "2021-01-08T00:00:00",
    "dateUpdated": "2024-09-16T17:38:11.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7545 (GCVE-0-2015-7545)

Vulnerability from cvelistv5 – Published: 2016-04-13 15:00 – Updated: 2024-08-06 07:51
VLAI?
Summary
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://rhn.redhat.com/errata/RHSA-2015-2515.html vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-updates/2015-1… vendor-advisoryx_refsource_SUSE
https://security.gentoo.org/glsa/201605-01 vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2015/12/08/5 mailing-listx_refsource_MLIST
https://lkml.org/lkml/2015/10/5/683 mailing-listx_refsource_MLIST
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security… x_refsource_CONFIRM
http://www.securitytracker.com/id/1034501 vdb-entryx_refsource_SECTRACK
http://www.oracle.com/technetwork/topics/security… x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security… x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1269794 x_refsource_CONFIRM
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-2835-1 vendor-advisoryx_refsource_UBUNTU
https://kernel.googlesource.com/pub/scm/git/git/+… x_refsource_CONFIRM
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2015/12/11/7 mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/78711 vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2015/12/09/8 mailing-listx_refsource_MLIST
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.slackware.com/security/viewer.php?l=sl… vendor-advisoryx_refsource_SLACKWARE
http://www.debian.org/security/2016/dsa-3435 vendor-advisoryx_refsource_DEBIAN
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:28.413Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2015:2515",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
          },
          {
            "name": "openSUSE-SU-2015:1968",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
          },
          {
            "name": "GLSA-201605-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201605-01"
          },
          {
            "name": "[oss-security] 20151208 CVE for git issue - please use CVE-2015-7545",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
          },
          {
            "name": "[linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lkml.org/lkml/2015/10/5/683"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
          },
          {
            "name": "1034501",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034501"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
          },
          {
            "name": "USN-2835-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2835-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
          },
          {
            "name": "[oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
          },
          {
            "name": "78711",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78711"
          },
          {
            "name": "[oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
          },
          {
            "name": "SSA:2016-123-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
          },
          {
            "name": "DSA-3435",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3435"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-10-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2015:2515",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
        },
        {
          "name": "openSUSE-SU-2015:1968",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
        },
        {
          "name": "GLSA-201605-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201605-01"
        },
        {
          "name": "[oss-security] 20151208 CVE for git issue - please use CVE-2015-7545",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
        },
        {
          "name": "[linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lkml.org/lkml/2015/10/5/683"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
        },
        {
          "name": "1034501",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034501"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
        },
        {
          "name": "USN-2835-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2835-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
        },
        {
          "name": "[oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
        },
        {
          "name": "78711",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78711"
        },
        {
          "name": "[oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
        },
        {
          "name": "SSA:2016-123-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
        },
        {
          "name": "DSA-3435",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3435"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-7545",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2015:2515",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
            },
            {
              "name": "openSUSE-SU-2015:1968",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
            },
            {
              "name": "GLSA-201605-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201605-01"
            },
            {
              "name": "[oss-security] 20151208 CVE for git issue - please use CVE-2015-7545",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
            },
            {
              "name": "[linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10",
              "refsource": "MLIST",
              "url": "https://lkml.org/lkml/2015/10/5/683"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
            },
            {
              "name": "1034501",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034501"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
            },
            {
              "name": "USN-2835-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2835-1"
            },
            {
              "name": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021",
              "refsource": "CONFIRM",
              "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
            },
            {
              "name": "[oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
            },
            {
              "name": "78711",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/78711"
            },
            {
              "name": "[oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
            },
            {
              "name": "SSA:2016-123-01",
              "refsource": "SLACKWARE",
              "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
            },
            {
              "name": "DSA-3435",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3435"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-7545",
    "datePublished": "2016-04-13T15:00:00",
    "dateReserved": "2015-09-29T00:00:00",
    "dateUpdated": "2024-08-06T07:51:28.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7082 (GCVE-0-2015-7082)

Vulnerability from cvelistv5 – Published: 2015-12-11 11:00 – Updated: 2024-08-06 07:36
VLAI?
Summary
Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode use cases.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:36:35.242Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT205642"
          },
          {
            "name": "APPLE-SA-2015-12-08-6",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
          },
          {
            "name": "1034340",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034340"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors.  NOTE: this CVE is associated only with Xcode use cases."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-05T20:57:01",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/HT205642"
        },
        {
          "name": "APPLE-SA-2015-12-08-6",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
        },
        {
          "name": "1034340",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034340"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2015-7082",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors.  NOTE: this CVE is associated only with Xcode use cases."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.apple.com/HT205642",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/HT205642"
            },
            {
              "name": "APPLE-SA-2015-12-08-6",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
            },
            {
              "name": "1034340",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034340"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2015-7082",
    "datePublished": "2015-12-11T11:00:00",
    "dateReserved": "2015-09-16T00:00:00",
    "dateUpdated": "2024-08-06T07:36:35.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23632 (GCVE-0-2021-23632)

Vulnerability from nvd – Published: 2022-03-17 11:20 – Updated: 2024-09-16 17:38
VLAI?
Summary
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work.
Severity ?
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • Remote Code Execution (RCE)
Assigner
References
Impacted products
Vendor Product Version
n/a git Affected: 0 , < unspecified (custom)
Credits
Paul-Emmanuel Raoul of SkypLabs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:08.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Paul-Emmanuel Raoul of SkypLabs"
        }
      ],
      "datePublic": "2022-03-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require(\"git\").Git; var repo = new Git(\"repo-test\"); var user_input = \"version; date\"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution (RCE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-17T11:20:22",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
        }
      ],
      "title": "Remote Code Execution (RCE)",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2022-03-17T11:16:18.518275Z",
          "ID": "CVE-2021-23632",
          "STATE": "PUBLIC",
          "TITLE": "Remote Code Execution (RCE)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "git",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Paul-Emmanuel Raoul of SkypLabs"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require(\"git\").Git; var repo = new Git(\"repo-test\"); var user_input = \"version; date\"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution (RCE)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-GIT-1568518",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-GIT-1568518"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23632",
    "datePublished": "2022-03-17T11:20:22.259001Z",
    "dateReserved": "2021-01-08T00:00:00",
    "dateUpdated": "2024-09-16T17:38:11.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7545 (GCVE-0-2015-7545)

Vulnerability from nvd – Published: 2016-04-13 15:00 – Updated: 2024-08-06 07:51
VLAI?
Summary
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://rhn.redhat.com/errata/RHSA-2015-2515.html vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-updates/2015-1… vendor-advisoryx_refsource_SUSE
https://security.gentoo.org/glsa/201605-01 vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2015/12/08/5 mailing-listx_refsource_MLIST
https://lkml.org/lkml/2015/10/5/683 mailing-listx_refsource_MLIST
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security… x_refsource_CONFIRM
http://www.securitytracker.com/id/1034501 vdb-entryx_refsource_SECTRACK
http://www.oracle.com/technetwork/topics/security… x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security… x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1269794 x_refsource_CONFIRM
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-2835-1 vendor-advisoryx_refsource_UBUNTU
https://kernel.googlesource.com/pub/scm/git/git/+… x_refsource_CONFIRM
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2015/12/11/7 mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/78711 vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2015/12/09/8 mailing-listx_refsource_MLIST
https://github.com/git/git/blob/master/Documentat… x_refsource_CONFIRM
http://www.slackware.com/security/viewer.php?l=sl… vendor-advisoryx_refsource_SLACKWARE
http://www.debian.org/security/2016/dsa-3435 vendor-advisoryx_refsource_DEBIAN
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:28.413Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2015:2515",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
          },
          {
            "name": "openSUSE-SU-2015:1968",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
          },
          {
            "name": "GLSA-201605-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201605-01"
          },
          {
            "name": "[oss-security] 20151208 CVE for git issue - please use CVE-2015-7545",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
          },
          {
            "name": "[linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lkml.org/lkml/2015/10/5/683"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
          },
          {
            "name": "1034501",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034501"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
          },
          {
            "name": "USN-2835-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2835-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
          },
          {
            "name": "[oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
          },
          {
            "name": "78711",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78711"
          },
          {
            "name": "[oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
          },
          {
            "name": "SSA:2016-123-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
          },
          {
            "name": "DSA-3435",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3435"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-10-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2015:2515",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
        },
        {
          "name": "openSUSE-SU-2015:1968",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
        },
        {
          "name": "GLSA-201605-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201605-01"
        },
        {
          "name": "[oss-security] 20151208 CVE for git issue - please use CVE-2015-7545",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
        },
        {
          "name": "[linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lkml.org/lkml/2015/10/5/683"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
        },
        {
          "name": "1034501",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034501"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
        },
        {
          "name": "USN-2835-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2835-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
        },
        {
          "name": "[oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
        },
        {
          "name": "78711",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78711"
        },
        {
          "name": "[oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
        },
        {
          "name": "SSA:2016-123-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
        },
        {
          "name": "DSA-3435",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3435"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-7545",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2015:2515",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-2515.html"
            },
            {
              "name": "openSUSE-SU-2015:1968",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html"
            },
            {
              "name": "GLSA-201605-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201605-01"
            },
            {
              "name": "[oss-security] 20151208 CVE for git issue - please use CVE-2015-7545",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/08/5"
            },
            {
              "name": "[linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10",
              "refsource": "MLIST",
              "url": "https://lkml.org/lkml/2015/10/5/683"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
            },
            {
              "name": "1034501",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034501"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269794"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt"
            },
            {
              "name": "USN-2835-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2835-1"
            },
            {
              "name": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021",
              "refsource": "CONFIRM",
              "url": "https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
            },
            {
              "name": "[oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/11/7"
            },
            {
              "name": "78711",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/78711"
            },
            {
              "name": "[oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/09/8"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt"
            },
            {
              "name": "SSA:2016-123-01",
              "refsource": "SLACKWARE",
              "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255"
            },
            {
              "name": "DSA-3435",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3435"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-7545",
    "datePublished": "2016-04-13T15:00:00",
    "dateReserved": "2015-09-29T00:00:00",
    "dateUpdated": "2024-08-06T07:51:28.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7082 (GCVE-0-2015-7082)

Vulnerability from nvd – Published: 2015-12-11 11:00 – Updated: 2024-08-06 07:36
VLAI?
Summary
Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode use cases.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:36:35.242Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT205642"
          },
          {
            "name": "APPLE-SA-2015-12-08-6",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
          },
          {
            "name": "1034340",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034340"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors.  NOTE: this CVE is associated only with Xcode use cases."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-05T20:57:01",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/HT205642"
        },
        {
          "name": "APPLE-SA-2015-12-08-6",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
        },
        {
          "name": "1034340",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034340"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2015-7082",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors.  NOTE: this CVE is associated only with Xcode use cases."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.apple.com/HT205642",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/HT205642"
            },
            {
              "name": "APPLE-SA-2015-12-08-6",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html"
            },
            {
              "name": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt"
            },
            {
              "name": "1034340",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034340"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2015-7082",
    "datePublished": "2015-12-11T11:00:00",
    "dateReserved": "2015-09-16T00:00:00",
    "dateUpdated": "2024-08-06T07:36:35.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}