CVE-2021-40330
Ubuntu Security Notice USN-5076-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.
La función git_connect_git en el archivo connect.c en Git versiones anteriores a 2.30.1, permite que la ruta de un repositorio contenga un carácter de nueva línea, que puede resultar en peticiones inesperadas entre protocolos, como es demostrado en la subcadena git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1
An update that fixes one vulnerability is now available. This update for git fixes the following issues. Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path. This update was imported from the SUSE:SLE-15:Update update project.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-08-31 CVE Reserved
- 2021-08-31 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-04-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html | Mailing List |
|
URL | Date | SRC |
---|---|---|
https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473 | 2024-08-04 |
URL | Date | SRC |
---|---|---|
https://github.com/git/git/compare/v2.30.0...v2.30.1 | 2022-11-07 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | < 2.30.1 Search vendor "Git-scm" for product "Git" and version " < 2.30.1" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
|