Homepage

Arbitrary Argument Injection The advisory has been revoked - it doesn't affect any version of package gitk  (opens in a new tab)

Threat Intelligence

EPSS
4.91% (92nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS6-GITK-2769692
  • published20 Apr 2022
  • disclosed13 Apr 2022
Report a new vulnerability Found a mistake?

Introduced: 13 Apr 2022

CVE-2022-25648  (opens in a new tab)
CWE-88  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:6.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gitk package and not the gitk package as distributed by Centos.

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

References