gsd-2022-46648
Vulnerability from gsd
Modified
2023-01-05 00:00
Details
The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file name in quotes and escape any special characters. If the 'Git#ls_files' method encountered a quoted file name it would use eval() to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.
Aliases
Aliases
CVE-2022-46648


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-46648",
    "id": "GSD-2022-46648"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "git",
            "purl": "pkg:gem/git"
          }
        }
      ],
      "aliases": [
        "CVE-2022-46648",
        "GHSA-pfpr-3463-c6jh"
      ],
      "details": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output\nof the \u0027git ls-files\u0027 command using eval() to unescape quoted file names.\nIf a file name was added to the git repository contained special characters,\nsuch as \u0027\\n\u0027, then the \u0027git ls-files\u0027 command would print the file name in\nquotes and escape any special characters.\nIf the \u0027Git#ls_files\u0027 method encountered a quoted file name it would use\neval() to unquote and unescape any special characters, leading to potential\nremote code execution. Version 1.13.0 of the git gem was released which\ncorrectly parses any quoted file names.\n",
      "id": "GSD-2022-46648",
      "modified": "2023-01-05T00:00:00.000Z",
      "published": "2023-01-05T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/ruby-git/ruby-git/pull/602"
        },
        {
          "type": "WEB",
          "url": "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 5.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Potential remote code execution in ruby-git"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2022-46648",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ruby-git",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "versions prior to v1.13.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ruby-git"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Code injection"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ruby-git/ruby-git",
            "refsource": "MISC",
            "url": "https://github.com/ruby-git/ruby-git"
          },
          {
            "name": "https://github.com/ruby-git/ruby-git/pull/602",
            "refsource": "MISC",
            "url": "https://github.com/ruby-git/ruby-git/pull/602"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN16765254/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
          },
          {
            "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-46648",
      "cvss_v3": 5.5,
      "date": "2023-01-05",
      "description": "The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output\nof the \u0027git ls-files\u0027 command using eval() to unescape quoted file names.\nIf a file name was added to the git repository contained special characters,\nsuch as \u0027\\n\u0027, then the \u0027git ls-files\u0027 command would print the file name in\nquotes and escape any special characters.\nIf the \u0027Git#ls_files\u0027 method encountered a quoted file name it would use\neval() to unquote and unescape any special characters, leading to potential\nremote code execution. Version 1.13.0 of the git gem was released which\ncorrectly parses any quoted file names.\n",
      "gem": "git",
      "ghsa": "pfpr-3463-c6jh",
      "patched_versions": [
        "\u003e= 1.13.0"
      ],
      "related": {
        "url": [
          "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0"
        ]
      },
      "title": "Potential remote code execution in ruby-git",
      "unaffected_versions": [
        "\u003c 1.2.0"
      ],
      "url": "https://github.com/ruby-git/ruby-git/pull/602"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.13.0",
          "affected_versions": "All versions before 1.13.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937",
            "CWE-94",
            "CWE-78"
          ],
          "date": "2023-02-02",
          "description": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.",
          "fixed_versions": [
            "1.13.0"
          ],
          "identifier": "CVE-2022-46648",
          "identifiers": [
            "CVE-2022-46648",
            "GHSA-pfpr-3463-c6jh",
            "GMS-2023-9"
          ],
          "not_impacted": "All versions starting from 1.13.0",
          "package_slug": "gem/git",
          "pubdate": "2023-01-17",
          "solution": "Upgrade to version 1.13.0 or above.",
          "title": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-46648",
            "https://github.com/ruby-git/ruby-git/pull/602",
            "https://github.com/ruby-git/ruby-git",
            "https://jvn.jp/en/jp/JVN16765254/index.html",
            "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml",
            "https://github.com/advisories/GHSA-pfpr-3463-c6jh"
          ],
          "uuid": "20a537f1-2b01-4dc6-9d7b-fc27f9cfacfe"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions starting from 1.2.0 before 1.13.0",
          "cwe_ids": [
            "CWE-1035",
            "CWE-78",
            "CWE-937"
          ],
          "date": "2023-01-09",
          "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) in git.",
          "fixed_versions": [
            "1.13.0"
          ],
          "identifier": "GMS-2023-9",
          "identifiers": [
            "GHSA-pfpr-3463-c6jh",
            "GMS-2023-9",
            "CVE-2022-46648"
          ],
          "not_impacted": "All versions before 1.2.0, all versions starting from 1.13.0",
          "package_slug": "gem/git",
          "pubdate": "2023-01-09",
          "solution": "Upgrade to version 1.13.0 or above.",
          "title": "Duplicate of ./gem/git/CVE-2022-46648.yml",
          "urls": [
            "https://github.com/ruby-git/ruby-git/pull/602",
            "https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git/CVE-2022-46648.yml",
            "https://github.com/advisories/GHSA-pfpr-3463-c6jh"
          ],
          "uuid": "7474ef01-3d4f-4f5d-9e8b-c4673c92935c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ruby-git_project:ruby-git:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-46648"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-94"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ruby-git/ruby-git/pull/602",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ruby-git/ruby-git/pull/602"
            },
            {
              "name": "https://github.com/ruby-git/ruby-git",
              "refsource": "MISC",
              "tags": [
                "Product",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ruby-git/ruby-git"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN16765254/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN16765254/index.html"
            },
            {
              "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.1,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-02-02T18:45Z",
      "publishedDate": "2023-01-17T10:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.