Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3145 advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

  - git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character,     which may result in unexpected cross-protocol requests, as demonstrated by the     git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. (CVE-2021-40330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2555-1 advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2555-1 advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the git packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Git is an open-source distributed revision control     system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as     files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while     cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on     Windows and macOS). Note that clean/smudge filters have     to be configured for that. Git for Windows configures     Git LFS by default, and is therefore vulnerable. The     problem has been patched in the versions published on     Tuesday, March 9th, 2021. As a workaound, if symbolic     link support is disabled in Git (e.g. via `git config
    --global core.symlinks false`), the described attack     won't work. Likewise, if no clean/smudge filters such     as Git LFS are configured globally (i.e. _before_     cloning), the attack is foiled. As always, it is best     to avoid cloning repositories from untrusted sources.
    The earliest impacted version is 2.14.2. The fix     versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3,     2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6,     2.18.5, 2.17.62.17.6.(CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Git is an open-source distributed revision control     system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as     files using a clean/smudge filter such as Git LFS,may     cause just-checked out script to be executed while     cloning onto a case-insensitive file system such as     NTFS,HFS+ or APFS (i.e. the default file systems on     Windows and macOS). Note that clean/smudge filters have     to be configured for that. Git for Windows configures     Git LFS by default,and is therefore vulnerable. The     problem has been patched in the versions published on     Tuesday,March 9th,2021. As a workaound,if symbolic link     support is disabled in Git (e.g. via `git config
    --global core.symlinks false`),the described attack     won't work. Likewise,if no clean/smudge filters such as     Git LFS are configured globally (i.e. _before_     cloning),the attack is foiled. As always,it is best to     avoid cloning repositories from untrusted     sources.(CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Git is an open-source distributed revision control     system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as     files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while     cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on     Windows and macOS). Note that clean/smudge filters have     to be configured for that. Git for Windows configures     Git LFS by default, and is therefore vulnerable. The     problem has been patched in the versions published on     Tuesday, March 9th, 2021. As a workaound, if symbolic     link support is disabled in Git (e.g. via `git config
    --global core.symlinks false`), the described attack     won't work. Likewise, if no clean/smudge filters such     as Git LFS are configured globally (i.e. _before_     cloning), the attack is foiled. As always, it is best     to avoid cloning repositories from untrusted sources.
    The earliest impacted version is     2.14.2.(CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Git is an open-source distributed revision control     system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as     files using a clean/smudge filter such as Git LFS,may     cause just-checked out script to be executed while     cloning onto a case-insensitive file system such as     NTFS,HFS+ or APFS (i.e. the default file systems on     Windows and macOS). Note that clean/smudge filters have     to be configured for that. Git for Windows configures     Git LFS by default,and is therefore vulnerable. The     problem has been patched in the versions published on     Tuesday,March 9th,2021. As a workaound,if symbolic link     support is disabled in Git (e.g. via `git config
    --global core.symlinks false`),the described attack     won't work. Likewise,if no clean/smudge filters such as     Git LFS are configured globally (i.e. _before_     cloning),the attack is foiled. As always,it is best to     avoid cloning repositories from untrusted     sources.(CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Git is an open-source distributed revision control     system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as     files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while     cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on     Windows and macOS). Note that clean/smudge filters have     to be configured for that. Git for Windows configures     Git LFS by default, and is therefore vulnerable. The     problem has been patched in the versions published on     Tuesday, March 9th, 2021. As a workaound, if symbolic     link support is disabled in Git (e.g. via `git config
    --global core.symlinks false`), the described attack     won't work. Likewise, if no clean/smudge filters such     as Git LFS are configured globally (i.e. _before_     cloning), the attack is foiled. As always, it is best     to avoid cloning repositories from untrusted     sources.(CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202104-01 (Git: User-assisted execution of arbitrary code)

    It was discovered that Git could be fooled into running remote code       during a clone on case-insensitive file systems with support for symbolic       links, if Git is configured globally to apply delay-capable clean/smudge       filters (such as Git LFS).
  Impact :

    A remote attacker could entice a user to clone a specially crafted       repository, possibly resulting in the remote execution of arbitrary code       with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

The version of git installed on the remote host is prior to 2.23.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1621 advisory.

    Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.18.5-2.73. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1490 advisory.

    Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4761-1 advisory.

    Matheus Tavares discovered that Git incorrectly handled delay-capable clean/smudge filters when being used     on case-insensitive filesystems. A remote attacker could possibly use this issue to execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-ffd0b2108d advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for git fixes the following issues :

  - On case-insensitive filesystems, with support for     symbolic links, if Git is configured globally to apply     delay-capable clean/smudge filters (such as Git LFS),     Git could be fooled into running remote code during a     clone. (bsc#1183026, CVE-2021-21300)

This update was imported from the SUSE:SLE-15:Update update project.

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability:

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-21300)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-63fcbd126e advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New git packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

This update for git fixes the following issues :

On case-insensitive filesystems, with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could be fooled into running remote code during a clone. (bsc#1183026, CVE-2021-21300)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
166092	Debian DLA-3145-1 : git - LTS security update	Nessus	Debian Local Security Checks	high
156521	EulerOS Virtualization 3.0.2.6 : git (EulerOS-SA-2021-2887)	Nessus	Huawei Local Security Checks	high
152157	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2021:2555-1)	Nessus	SuSE Local Security Checks	high
152154	openSUSE 15 Security Update : git (openSUSE-SU-2021:2555-1)	Nessus	SuSE Local Security Checks	high
151242	EulerOS Virtualization 3.0.6.6 : git (EulerOS-SA-2021-2033)	Nessus	Huawei Local Security Checks	high
151172	EulerOS Virtualization for ARM 64 3.0.6.0 : git (EulerOS-SA-2021-1998)	Nessus	Huawei Local Security Checks	high
150227	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-1923)	Nessus	Huawei Local Security Checks	high
150179	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-1944)	Nessus	Huawei Local Security Checks	high
149563	EulerOS 2.0 SP8 : git (EulerOS-SA-2021-1870)	Nessus	Huawei Local Security Checks	high
149540	EulerOS 2.0 SP5 : git (EulerOS-SA-2021-1897)	Nessus	Huawei Local Security Checks	high
149221	GLSA-202104-01 : Git: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
148193	Amazon Linux 2 : git (ALAS-2021-1621)	Nessus	Amazon Linux Local Security Checks	high
148131	Amazon Linux AMI : git (ALAS-2021-1490)	Nessus	Amazon Linux Local Security Checks	high
148030	Photon OS 4.0: Git PHSA-2021-4.0-0004	Nessus	PhotonOS Local Security Checks	high
148010	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Git vulnerability (USN-4761-1)	Nessus	Ubuntu Local Security Checks	high
147825	Photon OS 1.0: Git PHSA-2021-1.0-0369	Nessus	PhotonOS Local Security Checks	high
147824	Photon OS 2.0: Git PHSA-2021-2.0-0327	Nessus	PhotonOS Local Security Checks	high
147821	Photon OS 3.0: Git PHSA-2021-3.0-0207	Nessus	PhotonOS Local Security Checks	high
147815	Fedora 32 : git (2021-ffd0b2108d)	Nessus	Fedora Local Security Checks	high
147799	openSUSE Security Update : git (openSUSE-2021-405)	Nessus	SuSE Local Security Checks	high
147749	Security Updates for Microsoft Visual Studio Products (March 2021)	Nessus	Windows : Microsoft Bulletins	high
147742	Fedora 33 : git (2021-63fcbd126e)	Nessus	Fedora Local Security Checks	high
147737	Slackware 14.0 / 14.1 / 14.2 / current : git (SSA:2021-070-01)	Nessus	Slackware Local Security Checks	high
147564	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2021:0757-1)	Nessus	SuSE Local Security Checks	high
147436	SUSE SLES12 Security Update : git (SUSE-SU-2021:0756-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-21300

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high