// For flags

CVE-2021-29468

Arbitrary code execution when checking out an attacker-controlled Git branch

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for Visual Studio.

Cygwin Git es un conjunto de parches para la herramienta de línea de comandos git para el entorno cygwin. Un repositorio especialmente diseñado que contiene enlaces simbólicos, así como archivos con caracteres de backslash en el nombre del archivo, puede hacer que se ejecute el código recién extraído al comprobar un repositorio usando Git en Cygwin. El problema se parcheará en Cygwin Git versión v2.31.1-2. En el momento de escribir este artículo, la vulnerabilidad está presente aguas arriba del código fuente de Git; Cualquier usuario de Cygwin que compile Git por sí mismo desde fuentes ascendentes debe aplicar manualmente un parche para mitigar la vulnerabilidad. Como mitigación, los usuarios no deben clonar ni extraer de repositorios de fuentes que no sean confiables. CVE-2019-1354 era una vulnerabilidad equivalente en Git para Visual Studio.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-03-30 CVE Reserved
  • 2021-04-29 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-09-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cygwin
Search vendor "Cygwin"
 Git
Search vendor "Cygwin" for product "Git"
 <= 2.31.1-1
Search vendor "Cygwin" for product "Git" and version " <= 2.31.1-1"
-
Affected