Command Injection
CVE-2022-24066

8.1HIGH

Key Information:

Vendor

Simple-git Project

Status
Simple-git
Vendor
CVE Published:
1 April 2022

What is CVE-2022-24066?

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

simple-git < 3.5.0

References

https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820
x_refsource_MISC
https://gist.github.com/lirantal/a930d902294b833514e82110...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Liran Tal
JSON
.