simple-git-3.2.4.tgz: 4 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - simple-git-3.2.4.tgz

Library home page: https://registry.npmjs.org/simple-git/-/simple-git-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: f7bc2f6548f5551edf9185262a35d59c2037407c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (simple-git version)	Remediation Possible**
CVE-2022-25912	Critical	9.8	simple-git-3.2.4.tgz	Direct	3.15.0	✅
CVE-2022-25860	Critical	9.8	simple-git-3.2.4.tgz	Direct	3.16.0	✅
CVE-2022-24433	Critical	9.8	simple-git-3.2.4.tgz	Direct	3.3.0	✅
CVE-2022-24066	Critical	9.8	simple-git-3.2.4.tgz	Direct	3.5.0	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25912

Vulnerable Library - simple-git-3.2.4.tgz

Library home page: https://registry.npmjs.org/simple-git/-/simple-git-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ simple-git-3.2.4.tgz (Vulnerable Library)

Found in HEAD commit: f7bc2f6548f5551edf9185262a35d59c2037407c

Found in base branch: main

Vulnerability Details

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

Publish Date: 2022-12-06

URL: CVE-2022-25912

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-25912

Release Date: 2022-12-06

Fix Resolution: 3.15.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25860

Vulnerable Library - simple-git-3.2.4.tgz

Library home page: https://registry.npmjs.org/simple-git/-/simple-git-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ simple-git-3.2.4.tgz (Vulnerable Library)

Found in HEAD commit: f7bc2f6548f5551edf9185262a35d59c2037407c

Found in base branch: main

Vulnerability Details

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.

Publish Date: 2023-01-26

URL: CVE-2022-25860

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-26

Fix Resolution: 3.16.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24433

Vulnerable Library - simple-git-3.2.4.tgz

Library home page: https://registry.npmjs.org/simple-git/-/simple-git-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ simple-git-3.2.4.tgz (Vulnerable Library)

Found in HEAD commit: f7bc2f6548f5551edf9185262a35d59c2037407c

Found in base branch: main

Vulnerability Details

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.

Publish Date: 2022-03-11

URL: CVE-2022-24433

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3f95-r44v-8mrg

Release Date: 2022-03-11

Fix Resolution: 3.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24066

Vulnerable Library - simple-git-3.2.4.tgz

Library home page: https://registry.npmjs.org/simple-git/-/simple-git-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ simple-git-3.2.4.tgz (Vulnerable Library)

Found in HEAD commit: f7bc2f6548f5551edf9185262a35d59c2037407c

Found in base branch: main

Vulnerability Details

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

Publish Date: 2022-04-01

URL: CVE-2022-24066

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-28xr-mwxg-3qc8

Release Date: 2022-04-01

Fix Resolution: 3.5.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.