CVE-2021-21300

Reference Links

• https://support.apple.com/en-us/HT212320 (Advisory)
• http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html
• http://seclists.org/fulldisclosure/2021/Apr/60
• http://www.openwall.com/lists/oss-security/2021/03/09/3
• https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks
• https://git-scm.com/docs/gitattributes#_filter
• https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592
• https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm
• https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/
• https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/
• https://security.gentoo.org/glsa/202104-01
• https://support.apple.com/kb/HT212320

Parent vulnerabilities

(Appears in the following advisories)

• HT212320

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2021-21300

Frequently Asked Questions

• What is CVE-2021-21300?

  CVE-2021-21300 is a vulnerability in Git that allows a specially crafted repository to execute arbitrary code.

• What is the severity of CVE-2021-21300?

  CVE-2021-21300 has a severity rating of 7.5 (high).

• Which versions of Git are affected by CVE-2021-21300?

  Git versions up to and including 2.14.2, and versions between 2.17.0 and 2.26.3 are affected by CVE-2021-21300.

• How can I fix CVE-2021-21300?

  To fix CVE-2021-21300, it is recommended to update Git to a version that is not affected by the vulnerability.

• Where can I find more information about CVE-2021-21300?

  You can find more information about CVE-2021-21300 in the references provided: [link1](https://support.apple.com/en-us/HT212320), [link2](http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html), [link3](http://seclists.org/fulldisclosure/2021/Apr/60).