8

CVE-2021-21300: apple xcode Link Following

CVSS: 8.0v3.1HighModified
AliasesALPINE-CVE-2021-21300MGASA-2021-0137SUSE-SU-2021:0756-1
Published 09-03-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-21300 is a high (CVSS 8.0) Link Following vulnerability in apple xcode. EPSS estimates a 88.53% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
60/100
0100
High · default modelHow is this calculated?
CVSS score
8.0/10
010
High · v3.1 (CVE.org)
EPSS score
88.53%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
DLA-3145-1OPENSUSE-SU-2024:10786-1

Timeline

  1. 09-03-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

88.53%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 88.53% on 18-09-2026

18-09-202618-10-2026
EPSS score
88.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • MetasploitMetasploitremoteVerified

    Git LFS Clone Command Exec

    exploit/multi/http/git_lfs_clone_command_exec

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Suse34 products
  • git&distro=HPE Helion OpenStack 8< 2.26.2-27.43.1
  • git&distro=SUSE Enterprise Storage 6< 2.26.2-3.31.1
  • git&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.26.2-3.31.1
  • git&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.26.2-3.31.1
  • git&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 2.26.2-3.31.1
Opensuse3 products
  • git-annex&distro=openSUSE Tumbleweed< 8.20210903-1.2
  • git&distro=openSUSE Leap 15.2< 2.26.2-lp152.2.6.1
  • git&distro=openSUSE Leap 15.3< 2.31.1-10.3.1
Debian2 products
Mageia2 products
  • git< 2.21.4-1.mga7
  • git< 2.30.2-1.mga8
Alpine1 product
  • git≥ 2.17.0, < 2.22.5-r0 | ≥ 2.17.0, < 2.24.4-r0 | ≥ 2.17.0, < 2.26.3-r0 | ≥ 2.17.0, < 2.30.2-r0
Apple1 product
Fedoraproject1 product
Git1 product
  • git≥ 2.14.2, < 2.17.62.17.6 | ≥ 2.18.0, < 2.18.5 | ≥ 2.19.0, < 2.19.6 | ≥ 2.20.0, < 2.20.5 | ≥ 2.21.0, < 2.21.4 | ≥ 2.22.0, < 2.22.5 | ≥ 2.23.0, < 2.23.4 | ≥ 2.24.0, < 2.24.4 | ≥ 2.25.0, < 2.25.5 | ≥ 2.26.0, < 2.26.3 | ≥ 2.27.0, < 2.27.1 | ≥ 2.28.0, < 2.28.1 | ≥ 2.29.0, < 2.29.3 | ≥ 2.30.0, < 2.30.1
Git-scm1 product
  • git≤ 2.14.2 | ≥ 2.17.0, < 2.17.6 | ≥ 2.18.0, < 2.18.5 | ≥ 2.19.0, < 2.19.6 | ≥ 2.20.0, < 2.20.5 | ≥ 2.21.0, < 2.21.4 | ≥ 2.22.0, < 2.22.5 | ≥ 2.23.0, < 2.23.4 | ≥ 2.24.0, < 2.24.4 | ≥ 2.25.0, < 2.25.5 | ≥ 2.26.0, < 2.26.3 | ≥ 2.29.0, < 2.29.3 | ≥ 2.30.0, < 2.30.2 | 2.27.0 | 2.28.0
Ubuntu1 product
  • git< 1:2.7.4-0ubuntu1.10 | < 1:2.17.1-1ubuntu0.8 | < 1:2.25.1-1ubuntu3.1

10 vendors · 47 products

References

31 links
Show all 31 references