Code Injection in Git - CVE-2021-21300

Vulnerability identifier: #VU51337

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21300

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Git for Visual Studio. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Git
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
Ubuntu
openEuler
Fedora
cflinuxfs3
ObjectScale
Apple Xcode
Visual Studio
CF Deployment
git (Ubuntu package)
git-core
git
git-arch
git-core-debuginfo
git-cvs
git-daemon
git-daemon-debuginfo
git-debugsource
git-email
git-gui
git-debuginfo
git-svn
git-svn-debuginfo
git-web
gitk
git-doc
git-help
perl-Git-SVN
perl-Git
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell EMC Storage Monitoring and Reporting (SMR)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

Install updates from vendor's website.

Git - addressed in versions 2.18.0, 2.19.0, 2.20.0, 2.21.0, 2.21.4, 2.22.5, 2.23.4, 2.24.4, 2.25.5, 2.26.3, 2.27.1, 2.28.1, 2.29.3, 2.30.2
cflinuxfs3 - update to 0.229.0
ObjectScale - update to 1.3.0
Apple Xcode - update to 12.5
CF Deployment - update to 16.7.0
git (Ubuntu package) - addressed in versions 1:2.7.4-0ubuntu1.10, 1:2.17.1-1ubuntu0.8, 1:2.25.1-1ubuntu3.1, 1:2.27.0-1ubuntu1.1
git-core - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-arch - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-core-debuginfo - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-cvs - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-daemon - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-daemon-debuginfo - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-debugsource - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-email - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-gui - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-debuginfo - addressed in versions 2.26.2-3.31.1, 2.31.1-10.3.1
git-svn - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-svn-debuginfo - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1
git-web - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
gitk - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git-doc - addressed in versions 2.26.2-3.31.1, 2.26.2-27.43.1, 2.31.1-10.3.1
git - addressed in versions 2.26.3-2.fc32, 2.30.2-1.fc33, 2.30.2-1.fc34
git-help - update to 2.27.0-3
git-gui - update to 2.27.0-3
git-web - update to 2.27.0-3
gitk - update to 2.27.0-3
git-svn - update to 2.27.0-3
perl-Git-SVN - update to 2.27.0-3
git-email - update to 2.27.0-3
git-daemon - update to 2.27.0-3
git-debugsource - update to 2.27.0-3
git-debuginfo - update to 2.27.0-3
git - update to 2.27.0-3
perl-Git - update to 2.27.0-3
perl-Git - update to 2.31.1-10.3.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.6.0.0
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
Visual Studio - addressed in versions 15.9.34, 16.7.13 16.7.31026.100, 16.8.7 16.8.31025.109, 16.9.3 16.9.31129.286, 16.11.11 16.11.32228.343

• Exploit #6658 - Git LFS Clone Command Exec (August 26, 2021)
• Exploit #5437 - CVE-2021-21300 (CVE-2021-21300) (May 18, 2021)

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21300

• Remote code execution in Microsoft Git for Visual Studio
• Slackware Linux update for git
• Arch Linux update for git
• Remote code execution in Cloud Foundry cflinuxfs3 and CF Deployment
• Amazon Linux AMI update for git
• Code injection in Apple Xcode 12.5
• Gentoo update for Git
• Multiple vulnerabilities in Dell EMC Unity
• SUSE update for git
• Ubuntu update for git
• Multiple vulnerabilities in Dell Storage Monitoring and Reporting (SMR)
• Code injection in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for git
• SUSE update for git
• openEuler update for git
• Fedora 34 update for git
• Fedora 32 update for git
• Fedora 33 update for git
• Multiple vulnerabilities in Dell ObjectScale
• Code Injection in Git