| module = "github.com/git-lfs/git-lfs" |
| package = "github.com/git-lfs/git-lfs/commands" |
| |
| description = """ |
| Due to the standard library behavior of exec.LookPath on Windows a number of methods may |
| result in arbitary code execution when cloning or operating on untrusted Git repositories. |
| """ |
| |
| os = ["windows"] |
| |
| cve = "CVE-2021-21237" |
| |
| credit = "@Ry0taK" |
| |
| symbols = ["PipeCommand"] |
| |
| published = "2021-04-14T12:00:00Z" |
| |
| [[versions]] |
| fixed = "v1.5.1-0.20210113180018-fc664697ed2c" |
| |
| [[additional_packages]] |
| module = "github.com/git-lfs/git-lfs" |
| package = "github.com/git-lfs/git-lfs/creds" |
| symbols = ["AskPassCredentialHelper.getFromProgram", "commandCredentialHelper.Approve"] |
| [[additional_packages.versions]] |
| fixed = "v1.5.1-0.20210113180018-fc664697ed2c" |
| |
| [[additional_packages]] |
| module = "github.com/git-lfs/git-lfs" |
| package = "github.com/git-lfs/git-lfs/lfs" |
| symbols = ["pipeExtensions"] |
| [[additional_packages.versions]] |
| fixed = "v1.5.1-0.20210113180018-fc664697ed2c" |
| |
| [[additional_packages]] |
| module = "github.com/git-lfs/git-lfs" |
| package = "github.com/git-lfs/git-lfs/lfshttp" |
| symbols = ["sshAuthClient.Resolve"] |
| [[additional_packages.versions]] |
| fixed = "v1.5.1-0.20210113180018-fc664697ed2c" |
| |
| [links] |
| commit = "https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a" |
| context = ["https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5"] |
