CVE-2021-40330 Other in n/a
Git allows newline characters in repository paths, potentially enabling unexpected cross-protocol requests during connection handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40330?
CVE-2021-40330 is a high-severity vulnerability in Debian Debian Linux, published on 31 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.
Which versions are affected by CVE-2021-40330?
It affects 2 products.
Linux distribution packages (9)
git SUSE:HPE Helion OpenStack 8 | All versions | 2.26.2-27.49.3 |
git SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.26.2-33.1 |
git SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 2.26.2-33.1 |
git SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.26.2-27.49.3 |
git SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.26.2-27.49.3 |
git SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.26.2-27.49.3 |
git SUSE:OpenStack Cloud 8 | All versions | 2.26.2-27.49.3 |
git openSUSE:Leap 15.2 | All versions | 2.26.2-lp152.2.12.1 |
git openSUSE:Leap 15.3 | All versions | 2.26.2-33.1 |
Products include Debian Debian Linux, Git-Scm Git.
How do I fix CVE-2021-40330?
Upgrade to a fixed version.
Is CVE-2021-40330 being exploited?
There is no known exploitation of CVE-2021-40330 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-40330, DEBIAN-CVE-2021-40330, GHSA-8r9w-64qj-m6cj, OESA-2021-1345, SUSE-SU-2021:3300-1, SUSE-SU-2021:3484-1 and 4 more.