"git apply --reject" partially-controlled arbitrary file write
CVE-2023-25652
7.5HIGH
What is CVE-2023-25652?
Git, a widely used revision control system, contains a vulnerability that allows attackers to overwrite files outside the working tree through the use of specially crafted input with the 'git apply --reject' command. This occurs when patches are sourced from untrusted entities, leading to potential data manipulation or loss. It's crucial for users to upgrade to the latest versions of Git to mitigate this risk. Users are advised to avoid applying untrusted patches and to verify patches with 'git apply --stat' prior to execution to prevent conflicts or unintended consequences.
Affected Version(s)
git < 2.30.9 < 2.30.9
git >= 2.31.0, < 2.31.8 < 2.31.0, 2.31.8
git >= 2.32.0, < 2.32.7 < 2.32.0, 2.32.7