CVE-2023-224905.5MediumCWE-59

CVE-2023-22490: Git vulnerable to local clone-based data exfiltration with non-local transports

git

Affected: git · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.7%probability of exploitation in the next 30 days

54th percentile

050100

Higher than 54% of scored CVEs

5.5MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

git · git>= 2.39.0, < 2.39.2; >= 2.38.0, < 2.38.4; >= 2.37.0, < 2.37.6; >= 2.36.0, < 2.36.5; >= 2.35.0, < 2.35.7; >= 2.34.0, < 2.34.7 and 4 more

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Link Following · File and Path Handling
Vendor: git
Published: February 2023
Band: Unlikely (under 1%), February 2023

CoverageNo articles yet

No CyberSIXT article names CVE-2023-22490 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.