A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance.
The vulnerability (CWE-88 — argument injection) occurs when fetching repository history using Git. An attacker can inject malicious arguments into a Git command call, which are then interpreted by the system as additional options or flags. This leads to unintended code execution on the Pagure instance without requiring privileges or user interaction.
An attacker can gain full control over the server — confidentiality, integrity and availability of data are at risk (CVSS rating C:H/I:H/A:H). Pagure instance takeover is possible, as well as reading or modifying repositories and user data.
Patches available from the vendor should be applied according to the references — detailed information about patched versions is available at https://bugzilla.redhat.com/show_bug.cgi?id=2315805 and https://access.redhat.com/security/cve/CVE-2024-47516.
Pagure application — versions indicated in the vendor's references (Red Hat Bugzilla #2315805).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H