A flaw was found in ansible-core's ansible.builtin.git module. The module
invokes git (ls-remote, clone, fetch) with the repository URL as a positional
argument and without a "–" separator, so a repository URL that begins with a
dash is interpreted by git as a command-line option. A caller that passes an
attacker-controlled repository URL to the module can trigger argument
injection (for example –upload-pack/–exec), resulting in arbitrary command
execution on the host running the module.
Bu kayıt NIST NVD kaynağından aktarılmıştır. Etkilenen sürümler, güncel değerlendirme ve üretici referansları için kaynak kaydı inceleyin.