blob: 6ed99fa3cdb82265685f68fd105da61f3b88fcad [file] [log] [blame]
module: github.com/git-lfs/git-lfs
package: github.com/git-lfs/git-lfs/commands
additional_packages:
- module: github.com/git-lfs/git-lfs
package: github.com/git-lfs/git-lfs/creds
symbols:
- AskPassCredentialHelper.getFromProgram
- commandCredentialHelper.Approve
versions:
- fixed: v1.5.1-0.20210113180018-fc664697ed2c
- module: github.com/git-lfs/git-lfs
package: github.com/git-lfs/git-lfs/lfs
symbols:
- pipeExtensions
versions:
- fixed: v1.5.1-0.20210113180018-fc664697ed2c
- module: github.com/git-lfs/git-lfs
package: github.com/git-lfs/git-lfs/lfshttp
symbols:
- sshAuthClient.Resolve
versions:
- fixed: v1.5.1-0.20210113180018-fc664697ed2c
versions:
- fixed: v1.5.1-0.20210113180018-fc664697ed2c
description: |
Due to the standard library behavior of exec.LookPath on Windows a number of methods may
result in arbitrary code execution when cloning or operating on untrusted Git repositories.
cves:
- CVE-2021-21237
credit: "@Ry0taK"
symbols:
- PipeCommand
os:
- windows
links:
commit: https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a
context:
- https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5