NewStart CGSL CORE 5.05 / MAIN 5.05 : git Vulnerability (NS-SA-2021-0141)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has git packages installed that are affected by a vulnerability: - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is simil...

SUSE: Security Advisory (SUSE-SU-2021:3484-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED12: git / git-arch / git-core / git-cvs / git-daemon / git-doc / etc (SUSE-SU-2021:3484-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3484-1 advisory. - CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in gitconnectgit repository path bsc1189992. Tenab...

SUSE-SU-2021:3484-1 Security update for git

This update for git fixes the following issues: - CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in gitconnectgit repository path bsc1189992...

Metasploit Wrap-Up

An Especially Spooky Season for Moodle This release has not one, two, or three, but FOUR authenticated Moodle exploit modules, or should I say moodules? H00die comes through again with not just modules, but also an artisanal, bespoke library to support further work. Two target the spell check...

Server-side Request Forgery (SSRF)

Overview @isomorphic-git/cors-proxy is a Proxy clone and push requests for the browser Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js. PoC GET...

CVE-2021-42341

checkpath in OpenRC before 0.44.7 uses the direct output of strlen to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced ...

CVE-2021-42341

checkpath in OpenRC before 0.44.7 uses the direct output of strlen to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced ...

Memory corruption

checkpath in OpenRC before 0.44.7 uses the direct output of strlen to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced ...

CVE-2021-42341

checkpath in OpenRC before 0.44.7 uses the direct output of strlen to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced ...

CVE-2021-42341

checkpath in OpenRC before 0.44.7 uses the direct output of strlen to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced ...

CVE-2021-42341

checkpath in OpenRC before 0.44.7 uses the direct output of strlen to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced ...

GitHub Revoked Insecure SSH Keys Generated by a Popular git Client

Code hosting platform GitHub has revoked weak SSH authentication keys that were generated via the GitKraken git GUI client due to a vulnerability in a third-party library that increased the likelihood of duplicated SSH keys. As an added precautionary measure, the Microsoft-owned company also said...

openSUSE: Security Advisory for git (openSUSE-SU-2021:1345-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE 15 Security Update : git (openSUSE-SU-2021:1345-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1345-1 advisory. - gitconnectgit in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected...

OPENSUSE-SU-2021:1345-1 Security update for git

This update for git fixes the following issues: - CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in gitconnectgit repository path bsc1189992. This update was imported from the SUSE:SLE-15:Update update project...

Security update for git (low)

openSUSE Security Update: Security update for git Announcement ID: openSUSE-SU-2021:1345-1 Rating: low References: 1189992 Cross-References: CVE-2021-40330 CVSS scores: CVE-2021-40330 SUSE: 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 An update that fixes...

CVE-2021-21684

A stored cross-site scripting XSS vulnerability was found in the Jenkins Git plugin. Due to not escaping the Git SHA-1 checksum parameters provided to commit notifications, an attacker is able to submit crafted commit notifications to the /git/notifyCommit endpoint...

openSUSE: Security Advisory for git (openSUSE-SU-2021:3300-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15: git / git-arch / git-core / git-cvs / git-daemon / git-doc / etc (SUSE-SU-2021:3300-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3300-1 advisory. - CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in gitconnectgit repository path bsc1189992. Tenable has...