CVE:CVE-2022-25648
CNNVD:CNNVD-202204-3791
ruby-git是一个 Ruby 库。可用于通过将系统调用包装到 git 二进制文件来创建、读取和操作 Git 存储库。
ruby-git存在安全漏洞，该漏洞源于当调用 fetch(remote = origin, opts = {}) 函数时，远程参数以可以设置附加标志的方式传递给 git fetch 子命令。附加标志可用于执行命令注入。
solution:Upgrade git git to a higher version than 1.11.0,and avoid the version (,1.11.0); Upgrade fedoraproject extra_packages_for_enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade fedoraproject fedora to a higher version than 34,35,36,and avoid the version 34,35,36; Upgrade debian debian_linux to a higher version than 10.0,and avoid the version 10.0