Git for Windows - Command Injection Vulnerability (CVE-2021-46101)
Summary
CVE-2021-46101: In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly. Affects git across 2 version ranges.
< 0
< 2ca94ab318509b3c271e82889938816bad76dfea
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git for Windows is a version control system that allows users to track changes in files and collaborate with others. It provides a command-line interface for managing repositories and performing various operations. However, a command injection vulnerability (CVE-2021-46101) has been discovered in Git for Windows versions up to 2.34.1. This vulnerability allows an attacker to execute arbitrary commands by manipulating the 'git pull' command.
Vulnerability Detail
The command injection vulnerability in Git for Windows arises when the 'git pull' command is used to update the local repository. An attacker can exploit this vulnerability by providing a specially crafted input that includes malicious commands. When the 'git pull' command is executed, the malicious commands are executed as well, leading to arbitrary code execution. This can result in unauthorized access, data loss, or further compromise of the system. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
To fix this vulnerability, it is recommended to update Git for Windows to version 2.34.2 or later. The latest version includes a patch that addresses the command injection vulnerability. Users can download the updated version from the official Git for Windows website or use package managers to update the software.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'git pull' command directly and instead use alternative methods to update the local repository. For example, users can manually download the updated repository files and replace the existing files. This eliminates the risk of command injection through the 'git pull' command.
Conclusion
The command injection vulnerability (CVE-2021-46101) in Git for Windows poses a significant risk to users. It allows attackers to execute arbitrary commands and potentially compromise the system. To mitigate this vulnerability, it is crucial to update Git for Windows to version 2.34.2 or later. Additionally, users can follow the provided workaround until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Git for Windows is a version control system that allows users to track changes in files and collaborate with others. It provides a command-line interface for managing repositories and performing various operations.
The command injection vulnerability in Git for Windows allows an attacker to execute arbitrary commands, potentially leading to unauthorized access, data loss, or further compromise of the system.
To fix the vulnerability, update Git for Windows to version 2.34.2 or later. The latest version includes a patch that addresses the command injection vulnerability.
As a temporary workaround, users can avoid using the 'git pull' command directly and instead use alternative methods to update the local repository.
Users can download the updated version of Git for Windows from the official Git for Windows website or use package managers to update the software.
Related vulnerabilities
Recent vulnerabilities recorded for git.
