Homepage

Arbitrary Argument Injection The advisory has been revoked - it doesn't affect any version of package git-daemon  (opens in a new tab)

Threat Intelligence

EPSS
4.91% (92nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS7-GITDAEMON-2769658
  • published20 Apr 2022
  • disclosed13 Apr 2022
Report a new vulnerability Found a mistake?

Introduced: 13 Apr 2022

CVE-2022-25648  (opens in a new tab)
CWE-88  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream git-daemon package and not the git-daemon package as distributed by Centos.

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

References