"git apply --reject" partially-controlled arbitrary file write
CVE-2023-25652
7.5HIGH
Summary
Git, a widely used revision control system, contains a vulnerability that allows attackers to overwrite files outside the working tree through the use of specially crafted input with the 'git apply --reject' command. This occurs when patches are sourced from untrusted entities, leading to potential data manipulation or loss. It's crucial for users to upgrade to the latest versions of Git to mitigate this risk. Users are advised to avoid applying untrusted patches and to verify patches with 'git apply --stat' prior to execution to prevent conflicts or unintended consequences.
Affected Version(s)
git < 2.30.9 < 2.30.9
git >= 2.31.0, < 2.31.8 < 2.31.0, 2.31.8
git >= 2.32.0, < 2.32.7 < 2.32.0, 2.32.7
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved