gsd - gsd-2022-46648

gsd-2022-46648

Vulnerability from gsd

Modified

2023-01-05 00:00

Details

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file name in quotes and escape any special characters. If the 'Git#ls_files' method encountered a quoted file name it would use eval() to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.

Aliases

CVE-2022-46648

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-46648",
    "id": "GSD-2022-46648"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "git",
            "purl": "pkg:gem/git"
          }
        }
      ],
      "aliases": [
        "CVE-2022-46648",
        "GHSA-pfpr-3463-c6jh"
      ],
      "details": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output\nof the \u0027git ls-files\u0027 command using eval() to unescape quoted file names.\nIf a file name was added to the git repository contained special characters,\nsuch as \u0027\\n\u0027, then the \u0027git ls-files\u0027 command would print the file name in\nquotes and escape any special characters.\nIf the \u0027Git#ls_files\u0027 method encountered a quoted file name it would use\neval() to unquote and unescape any special characters, leading to potential\nremote code execution. Version 1.13.0 of the git gem was released which\ncorrectly parses any quoted file names.\n",
      "id": "GSD-2022-46648",
      "modified": "2023-01-05T00:00:00.000Z",
      "published": "2023-01-05T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/ruby-git/ruby-git/pull/602"
        },
        {
          "type": "WEB",
          "url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 5.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Potential remote code execution in ruby-git"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2022-46648",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ruby-git",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "versions prior to v1.13.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ruby-git"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Code injection"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ruby-git/ruby-git",
            "refsource": "MISC",
            "url": "https://github.com/ruby-git/ruby-git"
          },
          {
            "name": "https://github.com/ruby-git/ruby-git/pull/602",
            "refsource": "MISC",
            "url": "https://github.com/ruby-git/ruby-git/pull/602"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN16765254/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
          },
          {
            "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-46648",
      "cvss_v3": 5.5,
      "date": "2023-01-05",
      "description": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output\nof the \u0027git ls-files\u0027 command using eval() to unescape quoted file names.\nIf a file name was added to the git repository contained special characters,\nsuch as \u0027\\n\u0027, then the \u0027git ls-files\u0027 command would print the file name in\nquotes and escape any special characters.\nIf the \u0027Git#ls_files\u0027 method encountered a quoted file name it would use\neval() to unquote and unescape any special characters, leading to potential\nremote code execution. Version 1.13.0 of the git gem was released which\ncorrectly parses any quoted file names.\n",
      "gem": "git",
      "ghsa": "pfpr-3463-c6jh",
      "patched_versions": [
        "\u003e= 1.13.0"
      ],
      "related": {
        "url": [
          "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
        ]
      },
      "title": "Potential remote code execution in ruby-git",
      "unaffected_versions": [
        "\u003c 1.2.0"
      ],
      "url": "https://github.com/ruby-git/ruby-git/pull/602"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.13.0",
          "affected_versions": "All versions before 1.13.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937",
            "CWE-94",
            "CWE-78"
          ],
          "date": "2023-02-02",
          "description": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.",
          "fixed_versions": [
            "1.13.0"
          ],
          "identifier": "CVE-2022-46648",
          "identifiers": [
            "CVE-2022-46648",
            "GHSA-pfpr-3463-c6jh",
            "GMS-2023-9"
          ],
          "not_impacted": "All versions starting from 1.13.0",
          "package_slug": "gem/git",
          "pubdate": "2023-01-17",
          "solution": "Upgrade to version 1.13.0 or above.",
          "title": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-46648",
            "https://github.com/ruby-git/ruby-git/pull/602",
            "https://github.com/ruby-git/ruby-git",
            "https://jvn.jp/en/jp/JVN16765254/index.html",
            "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml",
            "https://github.com/advisories/GHSA-pfpr-3463-c6jh"
          ],
          "uuid": "20a537f1-2b01-4dc6-9d7b-fc27f9cfacfe"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions starting from 1.2.0 before 1.13.0",
          "cwe_ids": [
            "CWE-1035",
            "CWE-78",
            "CWE-937"
          ],
          "date": "2023-01-09",
          "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) in git.",
          "fixed_versions": [
            "1.13.0"
          ],
          "identifier": "GMS-2023-9",
          "identifiers": [
            "GHSA-pfpr-3463-c6jh",
            "GMS-2023-9",
            "CVE-2022-46648"
          ],
          "not_impacted": "All versions before 1.2.0, all versions starting from 1.13.0",
          "package_slug": "gem/git",
          "pubdate": "2023-01-09",
          "solution": "Upgrade to version 1.13.0 or above.",
          "title": "Duplicate of ./gem/git/CVE-2022-46648.yml",
          "urls": [
            "https://github.com/ruby-git/ruby-git/pull/602",
            "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml",
            "https://github.com/advisories/GHSA-pfpr-3463-c6jh"
          ],
          "uuid": "7474ef01-3d4f-4f5d-9e8b-c4673c92935c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ruby-git_project:ruby-git:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-46648"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-94"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ruby-git/ruby-git/pull/602",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ruby-git/ruby-git/pull/602"
            },
            {
              "name": "https://github.com/ruby-git/ruby-git",
              "refsource": "MISC",
              "tags": [
                "Product",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ruby-git/ruby-git"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN16765254/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
            },
            {
              "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.1,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-02-02T18:45Z",
      "publishedDate": "2023-01-17T10:15Z"
    }
  }
}

ghsa-pfpr-3463-c6jh

Vulnerability from github

Published

2023-01-09 21:55

Modified

2023-01-24 23:28

Severity ?

8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

ruby-git has potential remote code execution vulnerability

Details

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in quotes and escape any special characters. If the Git#ls_files method encountered a quoted file name it would use eval() to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "git"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-46648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-09T21:55:14Z",
    "nvd_published_at": "2023-01-17T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the `git ls-files` command using `eval()` to unescape quoted file names. If a file name was added to the git repository contained special characters, such as `\\n`, then the `git ls-files` command would print the file name in quotes and escape any special characters. If the `Git#ls_files` method encountered a quoted file name it would use `eval()` to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.\n",
  "id": "GHSA-pfpr-3463-c6jh",
  "modified": "2023-01-24T23:28:35Z",
  "published": "2023-01-09T21:55:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46648"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby-git/ruby-git/pull/602"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ruby-git/ruby-git"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ruby-git has potential remote code execution vulnerability"
}

cve-2022-46648

Vulnerability from cvelistv5

Published

2023-01-17 00:00

Modified

2024-08-03 14:39

Severity ?

Summary

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.

References

▼	URL	Tags
	https://github.com/ruby-git/ruby-git
	https://github.com/ruby-git/ruby-git/pull/602
	https://jvn.jp/en/jp/JVN16765254/index.html
	https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html	mailing-list

Impacted products

▼	Vendor	Product
	ruby-git	ruby-git

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:38.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ruby-git/ruby-git"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ruby-git/ruby-git/pull/602"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
          },
          {
            "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ruby-git",
          "vendor": "ruby-git",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to v1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Code injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-31T00:00:00",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://github.com/ruby-git/ruby-git"
        },
        {
          "url": "https://github.com/ruby-git/ruby-git/pull/602"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
        },
        {
          "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-46648",
    "datePublished": "2023-01-17T00:00:00",
    "dateReserved": "2022-12-28T00:00:00",
    "dateUpdated": "2024-08-03T14:39:38.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

gsd-2022-46648

Vulnerability from gsd

ghsa-pfpr-3463-c6jh

Vulnerability from github

cve-2022-46648

Vulnerability from cvelistv5

Tags