CVE-2021-21300

A flaw was found in git, in which a specially-crafted repository that contains a symbolic link may cause just-checked out script to be executed while cloning.

This vulnerability affects case-insensitive file systems, therefore typical Linux scenarios should be safe. However, as per upstream, exploitation is even possible on Linux under certain circumstances.

Red Hat CodeReady Studio 12 is not affected by this flaw because Jboss Forge Addon uses jgit which is a different (Java) git implementation than git itself.

In RHEL-8.6 and above, we currently provide git-2.31.x and later versions, which are not impacted by CVE-2021-21300. The vulnerability affects versions prior git-2.30.1.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. before cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources.