gsd - gsd-2022-46648

GSD-2022-46648

Vulnerability from gsd - Updated: 2023-01-05 00:00

Details

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file name in quotes and escape any special characters. If the 'Git#ls_files' method encountered a quoted file name it would use eval() to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.

Aliases

CVE-2022-46648

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-46648",
    "id": "GSD-2022-46648"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "git",
            "purl": "pkg:gem/git"
          }
        }
      ],
      "aliases": [
        "CVE-2022-46648",
        "GHSA-pfpr-3463-c6jh"
      ],
      "details": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output\nof the \u0027git ls-files\u0027 command using eval() to unescape quoted file names.\nIf a file name was added to the git repository contained special characters,\nsuch as \u0027\\n\u0027, then the \u0027git ls-files\u0027 command would print the file name in\nquotes and escape any special characters.\nIf the \u0027Git#ls_files\u0027 method encountered a quoted file name it would use\neval() to unquote and unescape any special characters, leading to potential\nremote code execution. Version 1.13.0 of the git gem was released which\ncorrectly parses any quoted file names.\n",
      "id": "GSD-2022-46648",
      "modified": "2023-01-05T00:00:00.000Z",
      "published": "2023-01-05T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/ruby-git/ruby-git/pull/602"
        },
        {
          "type": "WEB",
          "url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 5.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Potential remote code execution in ruby-git"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2022-46648",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ruby-git",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "versions prior to v1.13.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ruby-git"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Code injection"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ruby-git/ruby-git",
            "refsource": "MISC",
            "url": "https://github.com/ruby-git/ruby-git"
          },
          {
            "name": "https://github.com/ruby-git/ruby-git/pull/602",
            "refsource": "MISC",
            "url": "https://github.com/ruby-git/ruby-git/pull/602"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN16765254/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
          },
          {
            "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-46648",
      "cvss_v3": 5.5,
      "date": "2023-01-05",
      "description": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output\nof the \u0027git ls-files\u0027 command using eval() to unescape quoted file names.\nIf a file name was added to the git repository contained special characters,\nsuch as \u0027\\n\u0027, then the \u0027git ls-files\u0027 command would print the file name in\nquotes and escape any special characters.\nIf the \u0027Git#ls_files\u0027 method encountered a quoted file name it would use\neval() to unquote and unescape any special characters, leading to potential\nremote code execution. Version 1.13.0 of the git gem was released which\ncorrectly parses any quoted file names.\n",
      "gem": "git",
      "ghsa": "pfpr-3463-c6jh",
      "patched_versions": [
        "\u003e= 1.13.0"
      ],
      "related": {
        "url": [
          "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
        ]
      },
      "title": "Potential remote code execution in ruby-git",
      "unaffected_versions": [
        "\u003c 1.2.0"
      ],
      "url": "https://github.com/ruby-git/ruby-git/pull/602"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.13.0",
          "affected_versions": "All versions before 1.13.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937",
            "CWE-94",
            "CWE-78"
          ],
          "date": "2023-02-02",
          "description": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.",
          "fixed_versions": [
            "1.13.0"
          ],
          "identifier": "CVE-2022-46648",
          "identifiers": [
            "CVE-2022-46648",
            "GHSA-pfpr-3463-c6jh",
            "GMS-2023-9"
          ],
          "not_impacted": "All versions starting from 1.13.0",
          "package_slug": "gem/git",
          "pubdate": "2023-01-17",
          "solution": "Upgrade to version 1.13.0 or above.",
          "title": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-46648",
            "https://github.com/ruby-git/ruby-git/pull/602",
            "https://github.com/ruby-git/ruby-git",
            "https://jvn.jp/en/jp/JVN16765254/index.html",
            "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml",
            "https://github.com/advisories/GHSA-pfpr-3463-c6jh"
          ],
          "uuid": "20a537f1-2b01-4dc6-9d7b-fc27f9cfacfe"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions starting from 1.2.0 before 1.13.0",
          "cwe_ids": [
            "CWE-1035",
            "CWE-78",
            "CWE-937"
          ],
          "date": "2023-01-09",
          "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) in git.",
          "fixed_versions": [
            "1.13.0"
          ],
          "identifier": "GMS-2023-9",
          "identifiers": [
            "GHSA-pfpr-3463-c6jh",
            "GMS-2023-9",
            "CVE-2022-46648"
          ],
          "not_impacted": "All versions before 1.2.0, all versions starting from 1.13.0",
          "package_slug": "gem/git",
          "pubdate": "2023-01-09",
          "solution": "Upgrade to version 1.13.0 or above.",
          "title": "Duplicate of ./gem/git/CVE-2022-46648.yml",
          "urls": [
            "https://github.com/ruby-git/ruby-git/pull/602",
            "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml",
            "https://github.com/advisories/GHSA-pfpr-3463-c6jh"
          ],
          "uuid": "7474ef01-3d4f-4f5d-9e8b-c4673c92935c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ruby-git_project:ruby-git:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-46648"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-94"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ruby-git/ruby-git/pull/602",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ruby-git/ruby-git/pull/602"
            },
            {
              "name": "https://github.com/ruby-git/ruby-git",
              "refsource": "MISC",
              "tags": [
                "Product",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ruby-git/ruby-git"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN16765254/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
            },
            {
              "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.1,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-02-02T18:45Z",
      "publishedDate": "2023-01-17T10:15Z"
    }
  }
}

GHSA-PFPR-3463-C6JH

Vulnerability from github – Published: 2023-01-09 21:55 – Updated: 2025-04-04 21:59

Summary

ruby-git has potential remote code execution vulnerability

Details

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in quotes and escape any special characters. If the Git#ls_files method encountered a quoted file name it would use eval() to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.

Severity ?

8.0 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "git"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-46648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-09T21:55:14Z",
    "nvd_published_at": "2023-01-17T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the `git ls-files` command using `eval()` to unescape quoted file names. If a file name was added to the git repository contained special characters, such as `\\n`, then the `git ls-files` command would print the file name in quotes and escape any special characters. If the `Git#ls_files` method encountered a quoted file name it would use `eval()` to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.",
  "id": "GHSA-pfpr-3463-c6jh",
  "modified": "2025-04-04T21:59:57Z",
  "published": "2023-01-09T21:55:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46648"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby-git/ruby-git/pull/602"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ruby-git/ruby-git"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ruby-git has potential remote code execution vulnerability"
}

CVE-2022-46648 (GCVE-0-2022-46648)

Vulnerability from cvelistv5 – Published: 2023-01-17 00:00 – Updated: 2025-04-04 18:52

Summary

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.

Severity ?

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

Code injection

Assigner

jpcert

References

URL

Tags

	https://github.com/ruby-git/ruby-git
	https://github.com/ruby-git/ruby-git/pull/602
	https://jvn.jp/en/jp/JVN16765254/index.html
	https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Impacted products

	Vendor	Product	Version
	ruby-git	ruby-git	Affected: versions prior to v1.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:38.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ruby-git/ruby-git"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ruby-git/ruby-git/pull/602"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
          },
          {
            "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-46648",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-04T18:51:53.886578Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-04T18:52:30.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ruby-git",
          "vendor": "ruby-git",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to v1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Code injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-31T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://github.com/ruby-git/ruby-git"
        },
        {
          "url": "https://github.com/ruby-git/ruby-git/pull/602"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
        },
        {
          "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-46648",
    "datePublished": "2023-01-17T00:00:00.000Z",
    "dateReserved": "2022-12-28T00:00:00.000Z",
    "dateUpdated": "2025-04-04T18:52:30.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GSD-2022-46648

GHSA-PFPR-3463-C6JH

CVE-2022-46648 (GCVE-0-2022-46648)

Tags

Sightings

Nomenclature