CVE-2022-25648
Fixed in a distro release EPSS 5%CVSS 8.1
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Products: git, fedoraproject extra_packages_for_enterprise_linux, fedoraproject fedora, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | git | 1.11.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | ruby-git | 1.2.8-1+deb10u1 |
| Debian 11 | ruby-git | 1.7.0-1+deb11u1 |
| Debian 12 | ruby-git | 1.13.1-1 |
| Debian 13 | ruby-git | 1.13.1-1 |
| Debian 14 | ruby-git | 1.13.1-1 |
| Red Hat satellite 6.12 | candlepin | 0:4.1.15-1.el8sat |
| Red Hat satellite 6.12 | candlepin-selinux | 0:4.1.15-1.el8sat |
| Red Hat satellite 6.12 | foreman | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-cli | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-debug | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-dynflow-sidekiq | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-ec2 | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-gce | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-journald | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-libvirt | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-openstack | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-ovirt | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-postgresql | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-service | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-telemetry | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-vmware | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | python-django | 0:3.2.14-2.el8pc |
| Red Hat satellite 6.12 | python39-django | 0:3.2.14-2.el8pc |
| Red Hat satellite 6.12 | rubygem-git | 0:1.11.0-1.el8sat |
| Red Hat satellite 6.12 | rubygem-nokogiri | 0:1.13.8-1.el8sat |
| Red Hat satellite 6.12 | rubygem-nokogiri-debuginfo | 0:1.13.8-1.el8sat |
| Red Hat satellite 6.12 | rubygem-nokogiri-debugsource | 0:1.13.8-1.el8sat |
| Red Hat satellite 6.12 | rubygem-rails-html-sanitizer | 0:1.4.3-2.el8sat |
| Red Hat satellite 6.12 | rubygem-sinatra | 1:2.2.0-1.el8sat |
| Red Hat satellite capsule 6.12 | foreman | 0:3.3.0.17-1.el8sat |
| Red Hat satellite capsule 6.12 | foreman-debug | 0:3.3.0.17-1.el8sat |
| Red Hat satellite capsule 6.12 | python-django | 0:3.2.14-2.el8pc |
| Red Hat satellite capsule 6.12 | python39-django | 0:3.2.14-2.el8pc |
| Red Hat satellite capsule 6.12 | rubygem-nokogiri | 0:1.13.8-1.el8sat |
| Red Hat satellite capsule 6.12 | rubygem-nokogiri-debuginfo | 0:1.13.8-1.el8sat |
| Red Hat satellite capsule 6.12 | rubygem-nokogiri-debugsource | 0:1.13.8-1.el8sat |
| Red Hat satellite capsule 6.12 | rubygem-sinatra | 1:2.2.0-1.el8sat |
| Red Hat satellite utils 6.12 | foreman | 0:3.3.0.17-1.el8sat |
| Red Hat satellite utils 6.12 | foreman-cli | 0:3.3.0.17-1.el8sat |
| Rocky Linux 8 | libdb | 0:5.3.28-42.el8_4 |
| Ubuntu 16.04 LTS | ruby-git | no fix |
| Ubuntu 18.04 LTS | ruby-git | no fix |
| Ubuntu 20.04 LTS | ruby-git | no fix |
| Ubuntu 22.04 LTS | ruby-git | no fix |
| Ubuntu 24.04 LTS | ruby-git | no fix |
| Ubuntu 25.10 | ruby-git | no fix |
| Ubuntu 26.04 LTS | ruby-git | no fix |
| Ubuntu 26.10 | ruby-git | no fix |