CVE-2022-24440

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:*
cpe:2.3:a:cocoapods:cocoapods-downloader:1.6.2:*:*:*:*:*:*:*

History

08 Apr 2022, 19:08

Type Values Removed Values Added
CWE CWE-88
CPE cpe:2.3:a:cocoapods:cocoapods-downloader:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 7.5
v3 : 9.8
References (MISC) https://github.com/CocoaPods/cocoapods-downloader/pull/128 - (MISC) https://github.com/CocoaPods/cocoapods-downloader/pull/128 - Patch, Third Party Advisory
References (MISC) https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414278 - (MISC) https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414278 - Third Party Advisory
References (MISC) https://github.com/CocoaPods/cocoapods-downloader/pull/124 - (MISC) https://github.com/CocoaPods/cocoapods-downloader/pull/124 - Patch, Third Party Advisory

01 Apr 2022, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-04-01 18:15

Updated : 2024-02-04 22:29


NVD link : CVE-2022-24440

Mitre link : CVE-2022-24440

CVE.ORG link : CVE-2022-24440


JSON object : View

Products Affected

cocoapods

  • cocoapods-downloader
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')