Veracode Vulnerability DatabaseVERACODE:22207Arbitrary Path Overwriting
3.3 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
3.6 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:P/A:P
Git is vulnerable to arbitrary path overwriting. It is possible via export-marks in-stream command feature.
| CPE | Name | Operator | Version |
|---|---|---|---|
| git | eq | 2.18.1__3.el8 | |
| git | eq | 2.18.1__4.el8 | |
| rh-git218-git | eq | 2.18.1__2.el7 | |
| rh-git218-git | eq | 2.18.1__3.el7 | |
| git:3.11 | eq | 2.24.1-r0 | |
| git:3.7 | eq | 2.15.3-r0 |
References
lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
access.redhat.com/errata/RHSA-2019:4356
access.redhat.com/errata/RHSA-2020:0228
access.redhat.com/security/updates/classification/#important
lore.kernel.org/git/[email protected]/T/#u
public-inbox.org/git/[email protected]/
support.apple.com/kb/HT210729
Related
3.3 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
3.6 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:P/A:P