Improper input validation in Cygwin Git
CVE-2021-29468
Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for Visual Studio.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.012 (66.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Cygwin Git
- Me-and Cygwin-git — versions < 2.31.1-2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Mailing List, x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-29468?
- CVE-2021-29468 is a high-severity vulnerability in Cygwin Git, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2021-04-29.
- How severe is CVE-2021-29468?
- High severity. CVSS v3 base score is 8.8 out of 10.