Vulnerability · Published Apr 19, 2022 · Assigned by snyk
CVE-2022-25648Command Injection
High 8.1
In plain English
A high-severity security flaw in git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)4.9%top 7.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-git | 1.13.1-1 | DEBIAN-CVE-2022-25648 |
| Debian:13 | ruby-git | 1.13.1-1 | DEBIAN-CVE-2022-25648 |
| Debian:14 | ruby-git | 1.13.1-1 | DEBIAN-CVE-2022-25648 |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:8506 |
| RubyGems | git | 1.11.0 | GHSA-69p6-wvmq-27gg |
| Ubuntu:22.04:LTS | ruby-git | no fix listed | UBUNTU-CVE-2022-25648 |
| Ubuntu:24.04:LTS | ruby-git | no fix listed | UBUNTU-CVE-2022-25648 |
| Ubuntu:25.10 | ruby-git | no fix listed | UBUNTU-CVE-2022-25648 |
| Ubuntu:26.04:LTS | ruby-git | no fix listed | UBUNTU-CVE-2022-25648 |
| Ubuntu:26.10 | ruby-git | no fix listed | UBUNTU-CVE-2022-25648 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-RUBY-GIT-2421270
- https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0
- https://github.com/ruby-git/ruby-git/pull/569
- FEDORA-2022-353e1cf8b6 vendor-advisory
- FEDORA-2022-f09e0d8b0e vendor-advisory
- FEDORA-2022-1aa40056fc vendor-advisory
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update mailing-list