Overview
- Description
- Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.
- Source
- security-advisories@github.com
- NVD status
- Modified
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
Weaknesses
- security-advisories@github.com
- CWE-190
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D0B133C-FC2B-4CBF-8840-C85F6D650510",
"versionEndIncluding": "2.30.6"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA5113C4-D095-4E76-A6C6-F849E11DFA9D",
"versionEndIncluding": "2.31.5",
"versionStartIncluding": "2.31.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B82E8E87-1083-45B9-A273-E6AB31548D56",
"versionEndIncluding": "2.32.4",
"versionStartIncluding": "2.32.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9162726-CACE-4CB9-ACDE-204655D6BB3B",
"versionEndIncluding": "2.33.5",
"versionStartIncluding": "2.33.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65D149AF-5604-4109-A60B-CB7B5BBBEE87",
"versionEndIncluding": "2.34.5",
"versionStartIncluding": "2.34.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "383C057B-98D3-4AC6-9D43-AE13CC81FEC4",
"versionEndIncluding": "2.35.5",
"versionStartIncluding": "2.35.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B191BB2-D3C9-440D-8F7F-237BE0CBDB96",
"versionEndIncluding": "2.36.3",
"versionStartIncluding": "2.36.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3F7AE8C-A383-442C-8E74-7BC13E8B251D",
"versionEndIncluding": "2.37.4",
"versionStartIncluding": "2.37.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28F8851A-1566-4F16-AEC4-2C09AC866C2A",
"versionEndIncluding": "2.38.2",
"versionStartIncluding": "2.38.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC98AC76-7F3E-45A0-9DE6-3D097CEE5199"
}
],
"operator": "OR"
}
]
}
]