CVE-2021-40330
Fixed in a distro release EPSS 3%
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.
Products: git-scm git, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.12 | git | 2.26.3-r1 |
| Debian 10 | git | 1:2.20.1-2+deb10u4 |
| Debian 12 | git | 1:2.30.1-1 |
| Debian 13 | git | 1:2.30.1-1 |
| Debian 14 | git | 1:2.30.1-1 |
| SUSE HPE Helion OpenStack 8 | git | 2.26.2-27.49.3 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | git | 2.26.2-33.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | git | 2.26.2-33.1 |
| SUSE Linux Enterprise Server 12 SP5 | git | 2.26.2-27.49.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | git | 2.26.2-27.49.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | git | 2.26.2-27.49.3 |
| SUSE OpenStack Cloud 8 | git | 2.26.2-27.49.3 |
| Ubuntu 18.04 LTS | git | 1:2.17.1-1ubuntu0.9 |
| Ubuntu 20.04 LTS | git | 1:2.25.1-1ubuntu3.2 |
| Ubuntu Pro 16.04 LTS | git | 1:2.7.4-0ubuntu1.10+esm1 |
| openSUSE Leap 15.2 | git | 2.26.2-lp152.2.12.1 |
| openSUSE Leap 15.3 | git | 2.26.2-33.1 |