Man-in-the-middle attack in Git - CVE-2018-1000021
Published: March 14, 2018 / Updated: December 28, 2020
Vulnerability identifier: #VU11082
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1000021
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.
The weakness exists due to insufficient validation of messages received from a Git server, which could include ANSI escape codes to the terminal on affected Git clients. A remote attacker can trick the victim into sending a request and interact with a malicious Git server and execute arbitrary code.
The weakness exists due to insufficient validation of messages received from a Git server, which could include ANSI escape codes to the terminal on affected Git clients. A remote attacker can trick the victim into sending a request and interact with a malicious Git server and execute arbitrary code.
Affected software
Git
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
How to mitigate CVE-2018-1000021
Install update from vendor's website.
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1