CVE-2021-21237: Git LFS can execute a Git binary from the current directory on Windows
First published: Fri Jan 15 2021(Updated: )
Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Git Large File Storage | <2.13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-21237?
CVE-2021-21237 has a high severity rating due to its potential to allow arbitrary code execution.
How do I fix CVE-2021-21237?
To fix CVE-2021-21237, update Git LFS to version 2.13.2 or later.
What are the consequences of exploiting CVE-2021-21237?
Exploiting CVE-2021-21237 allows an attacker to execute arbitrary code on the victim's system.
Which versions of Git LFS are affected by CVE-2021-21237?
CVE-2021-21237 affects Git LFS versions prior to 2.13.2.
Where does CVE-2021-21237 pose a risk?
CVE-2021-21237 poses a risk primarily on Windows systems when using malicious repositories.
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/remedy
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/git large file storage project
- canonical/git large file storage