Information disclosure in Git - CVE-2021-40330

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU56690

Information disclosure in Git - CVE-2021-40330

Published: September 17, 2021


Vulnerability identifier: #VU56690
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-40330
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the git_connect_git in connect.c. A remote attacker can gain unauthorized access to sensitive information on the system.


Affected software

Git
cflinuxfs3
Dell Secure Connect Gateway
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
Ubuntu
openEuler
git (Ubuntu package)
git
git-doc
gitk
git-web
git-svn-debuginfo
git-svn
git-gui
git-daemon-debuginfo
git-daemon
git-cvs
git-core-debuginfo
git-core
git-arch
git-debugsource
git-email
perl-Git-SVN
perl-Git
git-help
git-debuginfo

How to mitigate CVE-2021-40330

Install updates from vendor's website.

Git - update to 2.30.1
cflinuxfs3 - update to 0.256.0
Dell Secure Connect Gateway - update to 5.14.00.10
git (Ubuntu package) - addressed in versions 1:2.17.1-1ubuntu0.9, 1:2.25.1-1ubuntu3.2
git - update to 2.26.2-27.49.3
git-doc - update to 2.26.2-27.49.3
gitk - update to 2.26.2-27.49.3
git-web - update to 2.26.2-27.49.3
git-svn-debuginfo - update to 2.26.2-27.49.3
git-svn - update to 2.26.2-27.49.3
git-gui - update to 2.26.2-27.49.3
git-daemon-debuginfo - update to 2.26.2-27.49.3
git-daemon - update to 2.26.2-27.49.3
git-cvs - update to 2.26.2-27.49.3
git-core-debuginfo - update to 2.26.2-27.49.3
git-core - update to 2.26.2-27.49.3
git-arch - update to 2.26.2-27.49.3
git-debugsource - update to 2.26.2-27.49.3
git-email - update to 2.26.2-27.49.3
perl-Git-SVN - update to 2.27.0-5
perl-Git - update to 2.27.0-5
git-email - update to 2.27.0-5
git-help - update to 2.27.0-5
gitk - update to 2.27.0-5
git-web - update to 2.27.0-5
git-gui - update to 2.27.0-5
git-svn - update to 2.27.0-5
git-debugsource - update to 2.27.0-5
git-daemon - update to 2.27.0-5
git-debuginfo - update to 2.27.0-5
git - update to 2.27.0-5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1

External References

Related Security Bulletins