CVE catalog

CVE-2021-40330

git: CVE-2021-40330

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.87% · Oct 25, 2026

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangitsid1:2.55.0-1fixed
Debiangitforky1:2.53.0-1fixed
Debiangittrixie1:2.47.3-0+deb13u1fixed
Debiangitbookworm1:2.39.5-0+deb12u3fixed
Debiangitbookworm-security1:2.39.5-0+deb12u2fixed
Alpinegit3.122.26.3-r1fixed
Ubuntugitpro1:2.5.0-1vulnerable
Ubuntugitpro1:2.6.2-1vulnerable
Ubuntugitpro1:2.6.3-1vulnerable
Ubuntugitpro1:2.6.4-1vulnerable
Ubuntugitpro1:2.7.0~rc3-1vulnerable
Ubuntugitpro1:2.7.0-1vulnerable
Ubuntugitpro1:2.7.3-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.2vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.3vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.4vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.5vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.6vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.7vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.8vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.9vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm1fixed
Ubuntugit18.041:2.14.1-1ubuntu4vulnerable
Ubuntugit18.041:2.15.1-1ubuntu2vulnerable
Ubuntugit18.041:2.17.0-1ubuntu1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.3vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.4vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.5vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.6vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.7vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.8vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.9fixed
Ubuntugit20.041:2.20.1-2ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu2vulnerable
Ubuntugit20.041:2.25.0-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.2fixed
Opensusegitleap 15.22.26.2-lp152.2.12.1fixed
Opensusegitleap 15.32.26.2-33.1fixed
Ubuntugitpro1:2.5.0-1vulnerable
Ubuntugitpro1:2.6.2-1vulnerable
Ubuntugitpro1:2.6.3-1vulnerable
Ubuntugitpro1:2.6.4-1vulnerable
Ubuntugitpro1:2.7.0~rc3-1vulnerable
Ubuntugitpro1:2.7.0-1vulnerable
Ubuntugitpro1:2.7.3-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.2vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.3vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.4vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.5vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.6vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.7vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.8vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.9vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm1fixed
Ubuntugit18.041:2.14.1-1ubuntu4vulnerable
Ubuntugit18.041:2.15.1-1ubuntu2vulnerable
Ubuntugit18.041:2.17.0-1ubuntu1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.3vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.4vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.5vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.6vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.7vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.8vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.9fixed
Ubuntugit20.041:2.20.1-2ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu2vulnerable
Ubuntugit20.041:2.25.0-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.2fixed
Susegitlinux enterprise module for basesystem 15 sp22.26.2-33.1fixed
Susegitlinux enterprise module for development tools 15 sp22.26.2-33.1fixed
Susegithpe helion openstack 82.26.2-27.49.3fixed
Susegitopenstack cloud 82.26.2-27.49.3fixed
Susegitlinux enterprise software development kit 12 sp52.26.2-27.49.3fixed
Susegitlinux enterprise server 12 sp52.26.2-27.49.3fixed
Susegitlinux enterprise server for sap applications 12 sp52.26.2-27.49.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangitsourcesid1:2.30.1-1not yet assignedNot reportedNot reported
Debiangitsourceforky1:2.30.1-1not yet assignedNot reportedNot reported
Debiangitsourcetrixie1:2.30.1-1not yet assignedNot reportedNot reported
Debiangitsourcebookworm1:2.30.1-1not yet assignedNot reportedNot reported
Alpinegitapk3.122.26.3-r1Not reportedALPINE-CVE-2021-40330Not reported
Ubuntugitdebpro1:2.7.4-0ubuntu1.10+esm1Not reportedUSN-5076-1Not reported
Ubuntugitdeb18.041:2.17.1-1ubuntu0.9Not reportedUSN-5076-1Not reported
Ubuntugitdeb20.041:2.25.1-1ubuntu3.2Not reportedUSN-5076-1Not reported
Opensusegitrpmleap 15.22.26.2-lp152.2.12.1Not reportedOPENSUSE-SU-2021:1345-1Not reported
Opensusegitrpmleap 15.32.26.2-33.1Not reportedOPENSUSE-SU-2021:3300-1Not reported
Ubuntugitdebpro1:2.7.4-0ubuntu1.10+esm1Not reportedUBUNTU-CVE-2021-40330Not reported
Ubuntugitdeb18.041:2.17.1-1ubuntu0.9Not reportedUBUNTU-CVE-2021-40330Not reported
Ubuntugitdeb20.041:2.25.1-1ubuntu3.2Not reportedUBUNTU-CVE-2021-40330Not reported
Susegitrpmlinux enterprise module for basesystem 15 sp22.26.2-33.1Not reportedSUSE-SU-2021:3300-1Not reported
Susegitrpmlinux enterprise module for development tools 15 sp22.26.2-33.1Not reportedSUSE-SU-2021:3300-1Not reported
Susegitrpmhpe helion openstack 82.26.2-27.49.3Not reportedSUSE-SU-2021:3484-1Not reported
Susegitrpmopenstack cloud 82.26.2-27.49.3Not reportedSUSE-SU-2021:3484-1Not reported
Susegitrpmlinux enterprise software development kit 12 sp52.26.2-27.49.3Not reportedSUSE-SU-2021:3484-1Not reported
Susegitrpmlinux enterprise server 12 sp52.26.2-27.49.3Not reportedSUSE-SU-2021:3484-1Not reported
Susegitrpmlinux enterprise server for sap applications 12 sp52.26.2-27.49.3Not reportedSUSE-SU-2021:3484-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [git]Fixed
    Details (4)
    • 1:2.39.5-0+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-all]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-cvs]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-doc]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-email]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-gui]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [gitk]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-man]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-svn]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [gitweb]Fixed

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · bookworm; dsa · git · debian · 12

[Debian 13 (Trixie)]

  • [git]Fixed
    Details (2)
    • 1:2.47.3-0+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

  • [git-all]Fixed

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

  • [git-cvs]Fixed

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

  • [git-doc]Fixed

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

  • [git-email]Fixed

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

  • [git-gui]Fixed

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

  • [gitk]Fixed

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.30.1-1

      dsa · git · debian · 13

Next results

Observed:

References