CVE-2021-40330

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.

Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and ClearCase with features like cheap local branching, convenient staging areas, and multiple workflows.

Security Fix(es):

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.(CVE-2021-40330)

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.

• CVE-2022-41903: fix out-of-bounds write caused by integer overflow
• CVE-2021-40330: forbid newlines in host and path
• CVE-2022-39260: reject too long command line strings
• CVE-2021-23521: implement size checks for .gitattributes
• CVE-2023-22490: prevent arbitrary path exfiltration when using non-local transports
• CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links

• CVE-2022-41903: fix out-of-bounds write caused by integer overflow
• CVE-2021-40330: forbid newlines in host and path
• CVE-2022-39260: reject too long command line strings
• CVE-2021-23521: implement size checks for .gitattributes
• CVE-2023-22490: prevent arbitrary path exfiltration when using non-local transports
• CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links

• CVE-2022-41903: fix out-of-bounds write caused by integer overflow
• CVE-2021-40330: forbid newlines in host and path
• CVE-2022-39260: reject too long command line strings
• CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links

• SECURITY UPDATE: out-of-bounds write caused by integer overflow
  • debian/patches/CVE-2022-41903.patch: use 'size_t' instead of 'int' to track the string lengths and so allow >2GB input sizes.
  • CVE-2022-41903
  • t-mark-submodule-clean-test-as-known-failure.patch: mark submodule clean test as known failure and so pass 'make test'.
• SECURITY UPDATE: possible cross-protocol requests
  • debian/patches/CVE-2021-40330.patch: forbid newlines in host and path.
  • CVE-2021-40330
• SECURITY UPDATE: out-of-bounds write and possible RCE caused by integer overflow
  • debian/patches/CVE-2022-39260.patch: reject too long command line strings in split_cmdline().
  • CVE-2022-39260
• SECURITY UPDATE: out-of-bounds write when reading an unreasonably large .gitattributes file
  • debian/patches/CVE-2021-23521.patch: implement line and overall size checks for .gitattributes files.
  • CVE-2021-23521
• SECURITY UPDATE: possible write outside of the repository's working directory
  • debian/patches/CVE-2023-23946.patch: prevent git-apply from writing behind newly created symbolic links.
  • CVE-2023-23946

• CVE-2022-41903: fix out-of-bounds write caused by integer overflow
• CVE-2021-40330: forbid newlines in host and path
• CVE-2022-39260: reject too long command line strings
• CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links

• CVE-2021-40330: forbid newlines in host and path in git_connect()
• CVE-2022-39260: shell - limit size of interactive commands

This update for git fixes the following issues:

• CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path (bsc#1189992).

This update was imported from the SUSE:SLE-15:Update update project.

This update for git fixes the following issues:

• CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path (bsc#1189992).

This update for git fixes the following issues:

• CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path (bsc#1189992).

This update for git fixes the following issues:

• CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path (bsc#1189992).

It was discovered that Git allowed newline characters in certain repository paths. An attacker could potentially use this issue to perform cross-protocol requests.