GHSA-FQFH-778M-2V32中危已审查

GitHub CLI can execute a git binary from the current directory

OSV 1.4.0 · github-reviewed · 修改于 2021-05-22 06:06

发布时间

2022-02-12 07:41

GitHub 审查时间

2021-05-22 06:06

NVD 发布时间

—

源文件

advisories/github-reviewed/2022/02/GHSA-fqfh-778m-2v32/GHSA-fqfh-778m-2v32.json

公告说明

Impact

GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.

Windows users who run gh inside untrusted directories are affected.

Patches

Users should upgrade to GitHub CLI v1.2.1.

Workarounds

Other than avoiding untrusted repositories, there is no workaround.

References

https://github.com/golang/go/issues/38736

受影响的软件包

github.com/cli/cli

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

无

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-fqfh-778m-2v32",
  "aliases": [],
  "details": "### Impact\nGitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\\git.exe` or `.\\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one.\n\nWindows users who run `gh` inside untrusted directories are affected.\n\n### Patches\nUsers should upgrade to GitHub CLI v1.2.1.\n\n### Workarounds\nOther than avoiding untrusted repositories, there is no workaround.\n\n### References\nhttps://github.com/golang/go/issues/38736",
  "summary": "GitHub CLI can execute a git binary from the current directory",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/cli/cli",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2021-05-21T22:06:12Z",
  "severity": [],
  "published": "2022-02-11T23:41:11Z",
  "references": [
    {
      "url": "https://github.com/cli/cli/security/advisories/GHSA-fqfh-778m-2v32",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-05-21T22:06:12Z"
  }
}