Critical Vulnerability in Git Package: Newline Character Exploit
Summary
ALPINE-CVE-2021-40330: git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aG... Affects git versions < 2.26.3-r1. Fixed in 2.26.3-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, data integrity, and support for distributed, non-linear workflows. However, a vulnerability has been identified in Git versions prior to 2.30.1, where a repository path can contain a newline character, leading to potential cross-protocol requests.
Vulnerability Detail
The vulnerability, identified as CVE-2021-40330, exists in the git_connect_git function within the connect.c file of Git. This flaw allows an attacker to craft a repository path containing newline characters, which can result in unexpected cross-protocol requests. For instance, a malicious user could exploit this by sending a request like 'git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1', potentially leading to unauthorized access or data leakage. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.26.3-r1
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that repository paths do not contain newline characters. This can be done by sanitizing input and validating paths before processing them in Git commands.
Conclusion
The vulnerability CVE-2021-40330 in Git poses significant risks due to its ability to exploit newline characters in repository paths. It is crucial for users to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git →
FAQ
CVE-2021-40330 is a vulnerability in Git that allows a repository path to contain newline characters, potentially leading to cross-protocol requests.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
If an immediate update is not possible, ensure that repository paths are sanitized to avoid newline characters as a temporary measure.
You can visit the official Git website or security advisories for detailed information on vulnerabilities and patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
