Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on     a malicious repository with a git.bat or git.exe file in the current directory, that program would be     executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is     the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and     prefers) the current directory when the name of a command run does not contain a directory separator.
    Other than avoiding untrusted repositories or using a different operating system, there is no workaround.
    This is fixed in v2.13.2. (CVE-2021-21237)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on
    a malicious repository with a git.bat or git.exe file in the current directory, that program would be
    executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is
    the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and
    prefers) the current directory when the name of a command run does not contain a directory separator.
    Other than avoiding untrusted repositories or using a different operating system, there is no workaround.
    This is fixed in v2.13.2. (CVE-2021-21237)

ID	Name	Product	Family	Type	Severity
257234	Linux Distros Unpatched Vulnerability : CVE-2021-21237	Nessus	Misc.	Local	high
432048	SCA: security update for github.com/git-lfs/git-lfs (GHSA-cx3w-xqmc-84g5)	Tenable Cloud Security	SCA Checks	Local	high
432048	SCA: security update for github.com/git-lfs/git-lfs (GHSA-cx3w-xqmc-84g5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2021-21237

high

Tenable Plugins

high

high

high