CVE-2018-1000021

It was found that the Git client printed server-sent ANSI escape codes to the terminal without any sanitization, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by a MitM attacker could potentially result in code execution, arbitrary file writes, or other attacks under highly specific circumstances dependent on the usage of a vulnerable terminal emulator by the user.

The vulnerability is considered moderate rather than important due to the specific and limited conditions required for exploitation. For an attack to succeed, a MitM attacker would need to intercept Git traffic and inject specially crafted ANSI escape sequences. The severity is mitigated by the fact that not all terminal emulators interpret escape sequences in a way that could result in code execution or harmful actions. Modern terminal emulators, especially those used in Red Hat Enterprise Linux, typically sanitize escape sequences or do not support dangerous behaviors like file manipulation or code execution triggered via ANSI sequences. As a result, the potential impact is constrained to terminal emulators with flawed handling of escape codes, reducing the overall risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.