Description
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | git | unspecified – < 1.11.0 | 1.11.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-git | 1.13.1-1 | — |
| Debian 13 | ruby-git | 1.13.1-1 | — |
| Debian 12 | ruby-git | 1.13.1-1 | — |
| Debian 11 | ruby-git | 1.7.0-1+deb11u1 | DLA-4406-1 |
| Debian 10 | ruby-git | 1.2.8-1+deb10u1 | DLA-3303-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-git | No fix yet | — |
| Ubuntu 26.04 LTS | ruby-git | No fix yet | — |
| Ubuntu 25.10 | ruby-git | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-git | No fix yet | — |
| Ubuntu 22.04 LTS | ruby-git | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ruby-git | No fix yet | — |
| Ubuntu 18.04 LTS | ruby-git | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-git | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | candlepin +1 | 4.1.15-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | foreman +13 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-git | 1.11.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-rails-html-sanitizer | 1.4.3-2.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:8506 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | git | < 1.11.0 | 1.11.0 | GHSA-69p6-wvmq-27gg |
Advisories 5
- RHSA-2022:8506 Red Hat Security Advisory: Satellite 6.12 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- DLA-3303-1 ruby-git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:8506 Important: Satellite 6.12 Release Rocky Linux Security Advisories · Feb 4, 2026
- DLA-4406-1 ruby-git - security update Debian Security (DSA / DLA) · Dec 15, 2025
- WID-SEC-2022-2059 Ruby: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Dec 14, 2025
References
- https://snyk.io/vuln/SNYK-RUBY-GIT-2421270
- https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0
- https://github.com/ruby-git/ruby-git/pull/569
- FEDORA-2022-353e1cf8b6 vendor-advisory
- FEDORA-2022-f09e0d8b0e vendor-advisory
- FEDORA-2022-1aa40056fc vendor-advisory
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3303-1] ruby-git security update mailing-list