CVE-2021-40330
High
Description
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.
SeverityHigh
CVSS7.5
Exploit probability87. percentile2.9%
Product
Git
PublishedAug 31, 2021
First seenAug 31, 2021
How to fix
Update
- git-scm git2.30.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| git-scm git | v < 2.30.1 | 2.30.1 |
| debian debian_linux | 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.