The malicious user is able to update a crafted config
file into repository's .git
directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected.
Repository file updates are prohibited to its .git
directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.
N/A
N/A
If you have any questions or comments about this advisory, please post on #6555.
{ "nvd_published_at": "2022-06-02T14:15:00Z", "cwe_ids": [ "CWE-78" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2022-06-02T20:52:23Z" }