Improper Handling of Alternate Data Stream Affecting org.webjars.npm:nodegit package, versions [0,]


0.0
high

Snyk CVSS

    Attack Complexity High
    Scope Changed
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 6.42% (94th percentile)
Expand this section
NVD
8.8 high
Expand this section
SUSE
8.8 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGWEBJARSNPM-542727
  • published 7 Jan 2020
  • disclosed 10 Dec 2019
  • credit Unknown

How to fix?

There is no fixed version for org.webjars.npm:nodegit.

Overview

org.webjars.npm:nodegit is a Node bindings to the libgit2 project.

Affected versions of this package are vulnerable to Improper Handling of Alternate Data Stream. Git was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone.

While the description contains "NTFS", this vulnerability can not only be exploited on Windows, but also on macOS when working on smb://-mounted network shares. The exploit involves naming a directory .git::$INDEX_ALLOCATION, allowing remote code execution during a regular git clone.

The fix for this CVE requires the fix for CVE-2019-1353.