Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for Visual Studio.
References
Link | Resource |
---|---|
https://cygwin.com/pipermail/cygwin-announce/2021-April/010018.html | Mailing List Patch Vendor Advisory |
https://github.com/me-and/Cygwin-Git/blob/main/check-backslash-safety.patch | Patch Third Party Advisory |
https://github.com/me-and/Cygwin-Git/security/advisories/GHSA-rmp3-wq55-f557 | Patch Third Party Advisory |
https://lore.kernel.org/git/CA+kUOa=juEdBMVr_gyTKjz7PkPt2DZHkXQyzcQmAWCsEHC_ssw%40mail.gmail.com/T/#u |
Configurations
History
07 Nov 2023, 03:32
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
11 May 2021, 16:17
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.8 |
CPE | cpe:2.3:a:cygwin:git:*:*:*:*:*:*:*:* | |
References | (MISC) https://github.com/me-and/Cygwin-Git/blob/main/check-backslash-safety.patch - Patch, Third Party Advisory | |
References | (MISC) https://cygwin.com/pipermail/cygwin-announce/2021-April/010018.html - Mailing List, Patch, Vendor Advisory | |
References | (CONFIRM) https://github.com/me-and/Cygwin-Git/security/advisories/GHSA-rmp3-wq55-f557 - Patch, Third Party Advisory | |
References | (MISC) https://lore.kernel.org/git/CA+kUOa=juEdBMVr_gyTKjz7PkPt2DZHkXQyzcQmAWCsEHC_ssw@mail.gmail.com/T/#u - Mailing List, Third Party Advisory |
29 Apr 2021, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-04-29 21:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-29468
Mitre link : CVE-2021-29468
CVE.ORG link : CVE-2021-29468
JSON object : View
Products Affected
cygwin
- git
CWE
CWE-20
Improper Input Validation