CVE-2022-25648: Command Injection
A flaw was found in ruby-git, where the package is vulnerable to command injection via the git argument. This flaw allows an attacker to set additional flags, which leads to performing command injections.
Other sources
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rubygem-gitto a version that resolves this vulnerability.Fixed in 0:1.11.0-1.el8 - Upgrade
Upgrade
redhat/ruby-gitto a version that resolves this vulnerability.Fixed in 1.11.0 - Upgrade
Upgrade
debian/ruby-gitto a version that resolves this vulnerability.Fixed in 1.13.1-1Fixed in 6.0.0-1 - Upgrade
Upgrade
debian/ruby-gitto a version that resolves this vulnerability.Fixed in 1.13.1-1 - Upgrade
Upgrade
ruby-gitto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-25648.
What is the severity level of CVE-2022-25648?
The severity level of CVE-2022-25648 is critical with a severity value of 9.8.
How does this vulnerability occur?
This vulnerability occurs due to command injection via the git argument injection in the ruby-git package.
What is the affected software?
The affected software includes versions before 1.11.0 of the ruby-git package, versions before 0:1.11.0-1.el8 of the rubygem-git package, Git Git versions up to 1.11.0, Extra Packages For Enterprise Linux 8.0, Fedora versions 34, 35, and 36, and Debian Debian Linux 10.0.
How can I fix CVE-2022-25648?
To fix CVE-2022-25648, update the ruby-git package to version 1.11.0 or later.