{"id":"CVE-2021-23521","aliases":["CLSA-2023-1677095411","CLSA-2023-1677095961","CLSA-2023-1677096675","DEBIAN-CVE-2021-23521","EUVD-2021-10488","GHSA-cv9m-jw92-c3v3","SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388608","UBUNTU-CVE-2021-23521"],"status":"published","title":"Link Following","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00544,"percentile":0.4615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2022-01-31T10:50:34Z","modified":"2026-10-23T18:04:49Z","fixes":[{"ecosystem":"Debian:12","package":"juce","fixed_in":["6.1.5~ds0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"juce","fixed_in":["6.1.5~ds0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"juce","fixed_in":["6.1.5~ds0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-1.el8.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-arch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-cvs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-daemon-run","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-daemon-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-man","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.5~ds0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.5~ds0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.5~ds0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+repack-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0~repack-1","5.2.0~repack-1","5.2.0~repack-2","5.2.0~repack-3","5.2.1~repack-1","5.2.1~repack-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.4~repack0-3","5.4.5~ds0-1","5.4.6~ds0-1","5.4.7~ds0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.7~ds0-2","6.1.3~ds0-1","6.1.4~ds0-1","6.1.5~ds0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.5+ds-1","7.0.5+ds-1build1","7.0.5+ds-1build2","7.0.5+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.6+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.12+ds-1","8.0.13+ds-1","8.0.14+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"juce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.6+ds-2","8.0.12+ds-1"]}],"products":[{"vendor":"juce","product":"juce"}],"references":[{"url":"https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388608","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23521"},{"url":"https://github.com/advisories/GHSA-cv9m-jw92-c3v3"},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1677095411.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1677095961.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1677096675","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23521","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23521","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23521","title":"Link Following","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-01-31T10:50:34.104Z","modified":"2024-09-17T02:51:34.161Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-10488","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-01-31T10:50:34Z","modified":"2024-09-17T02:51:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:36.981601Z"}],"ghsa":[{"id":"GHSA-cv9m-jw92-c3v3","title":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a...","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-02-08T00:00:47Z","modified":"2023-02-03T05:05:27Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:53:44.391187Z"}],"nvd":[{"id":"CVE-2021-23521","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-01-31T11:15:07.933Z","modified":"2026-06-17T03:38:48.987Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:07:04.178977Z"}],"osv":[{"id":"CVE-2021-23521","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-01-31T11:15:07.933Z","modified":"2026-10-20T14:24:30.181983239Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23521","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-01-31T11:15:07.933Z","modified":"2026-10-23T18:04:49.5015979Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-23521","description":"This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.","status":"published","published":"2022-01-31T11:15:00Z","modified":"2026-10-17T12:57:11.840264337Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2023-1677095411","title":"git: Fix of 6 CVEs","description":"- CVE-2022-41903: fix out-of-bounds write caused by integer overflow\n- CVE-2021-40330: forbid newlines in host and path\n- CVE-2022-39260: reject too long command line strings\n- CVE-2021-23521: implement size checks for .gitattributes\n- CVE-2023-22490: prevent arbitrary path exfiltration when using non-local transports\n- CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links","status":"published","published":"2023-02-22T19:50:11Z","modified":"2026-10-21T10:47:56.923812001Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1677095961","title":"git: Fix of 6 CVEs","description":"- CVE-2022-41903: fix out-of-bounds write caused by integer overflow\n- CVE-2021-40330: forbid newlines in host and path\n- CVE-2022-39260: reject too long command line strings\n- CVE-2021-23521: implement size checks for .gitattributes\n- CVE-2023-22490: prevent arbitrary path exfiltration when using non-local transports\n- CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links","status":"published","published":"2023-02-22T19:59:21Z","modified":"2026-10-21T10:48:24.038518896Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1677096675","title":"Fix of 5 CVEs","description":"\n   * SECURITY UPDATE: out-of-bounds write caused by integer overflow\n     - debian/patches/CVE-2022-41903.patch: use 'size_t' instead of\n       'int' to track the string lengths and so allow \u003e2GB input sizes.\n     - CVE-2022-41903\n     - t-mark-submodule-clean-test-as-known-failure.patch: mark\n       submodule clean test as known failure and so pass 'make test'.\n   * SECURITY UPDATE: possible cross-protocol requests\n     - debian/patches/CVE-2021-40330.patch: forbid newlines in host\n       and path.\n     - CVE-2021-40330\n   * SECURITY UPDATE: out-of-bounds write and possible RCE caused by\n     integer overflow\n     - debian/patches/CVE-2022-39260.patch: reject too long command\n       line strings in split_cmdline().\n     - CVE-2022-39260\n   * SECURITY UPDATE: out-of-bounds write when reading an unreasonably\n     large .gitattributes file\n     - debian/patches/CVE-2021-23521.patch: implement line and overall\n       size checks for .gitattributes files.\n     - CVE-2021-23521\n   * SECURITY UPDATE: possible write outside of the repository's\n     working directory\n     - debian/patches/CVE-2023-23946.patch: prevent git-apply from\n       writing behind newly created symbolic links.\n     - CVE-2023-23946","status":"published","published":"2023-02-22T20:11:15Z","modified":"2026-06-04T10:03:38.164606622Z","updated_at":"2026-11-02T15:43:40.176048Z"}]}}