CVE-2021-40330
31.08.2021, 04:15
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| git-scm | git | 𝑥 < 2.30.1 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| git |
| ||||||||||||
| git-arch |
| ||||||||||||
| git-core |
| ||||||||||||
| git-cvs |
| ||||||||||||
| git-daemon |
| ||||||||||||
| git-doc |
| ||||||||||||
| git-email |
| ||||||||||||
| git-gui |
| ||||||||||||
| git-svn |
| ||||||||||||
| git-web |
| ||||||||||||
| gitk |
|
References