gitattributes parsing integer overflow in git
CVE-2022-23521

9.8CRITICAL

Key Information:

Vendor

Git

Status
Git
Vendor
CVE Published:
17 January 2023

What is CVE-2022-23521?

The vulnerability in Git arises from improper handling of gitattributes, which can lead to multiple integer overflows when parsing extensive path patterns or attributes. This issue can be exploited via a specially crafted .gitattributes file present in commit history, potentially permitting arbitrary heap reads and writes. Such vulnerabilities may enable remote code execution risks. It is crucial for users to upgrade to the patched versions released on January 17, 2023, starting from v2.30.7, as no workarounds currently exist for mitigating this issue.

Affected Version(s)

git < 2.30.7 < 2.30.7

git >= 2.31.0, < 2.31.6 < 2.31.0, 2.31.6

git >= 2.32.0, < 2.32.5 < 2.32.0, 2.32.5

References

https://github.com/git/git/security/advisories/GHSA-c738-...
x_refsource_CONFIRM
https://github.com/git/git/commit/508386c6c5857b4faa2c3e4...
x_refsource_MISC
https://security.gentoo.org/glsa/202312-15

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.