| module: github.com/git-lfs/git-lfs |
| package: github.com/git-lfs/git-lfs/commands |
| additional_packages: |
| - module: github.com/git-lfs/git-lfs |
| package: github.com/git-lfs/git-lfs/creds |
| symbols: |
| - AskPassCredentialHelper.getFromProgram |
| - commandCredentialHelper.Approve |
| versions: |
| - fixed: v1.5.1-0.20210113180018-fc664697ed2c |
| - module: github.com/git-lfs/git-lfs |
| package: github.com/git-lfs/git-lfs/lfs |
| symbols: |
| - pipeExtensions |
| versions: |
| - fixed: v1.5.1-0.20210113180018-fc664697ed2c |
| - module: github.com/git-lfs/git-lfs |
| package: github.com/git-lfs/git-lfs/lfshttp |
| symbols: |
| - sshAuthClient.Resolve |
| versions: |
| - fixed: v1.5.1-0.20210113180018-fc664697ed2c |
| versions: |
| - fixed: v1.5.1-0.20210113180018-fc664697ed2c |
| description: | |
| Due to the standard library behavior of exec.LookPath on Windows a number of methods may |
| result in arbitrary code execution when cloning or operating on untrusted Git repositories. |
| cves: |
| - CVE-2021-21237 |
| credit: "@Ry0taK" |
| symbols: |
| - PipeCommand |
| os: |
| - windows |
| links: |
| commit: https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a |
| context: |
| - https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5 |
