CVE-2023-22490: Git vulnerable to local clone-based data exfiltration with non-local transports
First published: Wed Feb 08 2023(Updated: )
A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links (CVE-2022-39253), the objects directory may still be a symbolic link.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/git | <0:2.39.3-1.el8_8 | 0:2.39.3-1.el8_8 |
| redhat/git | <0:2.39.3-1.el9_2 | 0:2.39.3-1.el9_2 |
| Git Git-shell | <2.30.8 | |
| Git Git-shell | >=2.31.0<2.31.7 | |
| Git Git-shell | >=2.32.0<2.32.6 | |
| Git Git-shell | >=2.33.0<2.33.7 | |
| Git Git-shell | >=2.34.0<2.34.7 | |
| Git Git-shell | >=2.35.0<2.35.7 | |
| Git Git-shell | >=2.36.0<2.36.5 | |
| Git Git-shell | >=2.37.0<2.37.6 | |
| Git Git-shell | >=2.38.0<2.38.4 | |
| Git Git-shell | >=2.39.0<2.39.2 |
Remedy
- Avoid cloning repositories from untrusted sources with --recurse-submodules. - Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update at each layer. Before doing so, inspect each new .gitmodules file to ensure that it does not contain suspicious module URLs.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2023-22490 https://nvd.nist.gov/vuln/detail/CVE-2023-22490 https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/ https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q
- https://bugzilla.redhat.com/show_bug.cgi?id=2168160
- https://access.redhat.com/errata/RHSA-2023:3246
- https://access.redhat.com/errata/RHSA-2023:3245
- https://access.redhat.com/security/cve/cve-2023-22490
- https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd
- https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85
- https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q
- https://security.gentoo.org/glsa/202312-15
- https://access.redhat.com/security/cve/CVE-2022-39253
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2170907
- https://access.redhat.com/errata/RHSA-2024:0407
Frequently Asked Questions
What is the vulnerability ID for this Git vulnerability?
The vulnerability ID for this Git vulnerability is CVE-2023-22490.
What is the severity level of CVE-2023-22490?
The severity level of CVE-2023-22490 is medium.
How can Git be tricked into using its local clone optimization even when using a non-local transport?
Git can be tricked into using its local clone optimization even when using a non-local transport by using a specially-crafted repository.
What versions of Git are affected by this vulnerability?
Versions of Git prior to 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 are affected by this vulnerability.
How can I fix CVE-2023-22490?
To fix CVE-2023-22490, update Git to version 2.39.3-1.el8_8 or 2.39.3-1.el9_2.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/author
- agent/softwarecombine
- agent/weakness
- agent/remedy
- agent/title
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-22490
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- package-manager/redhat
- vendor/git-scm
- canonical/git git-shell
- version/git git-shell/2.31.0
- version/git git-shell/2.32.0
- version/git git-shell/2.33.0
- version/git git-shell/2.34.0
- version/git git-shell/2.35.0
- version/git git-shell/2.36.0
- version/git git-shell/2.37.0
- version/git git-shell/2.38.0
- version/git git-shell/2.39.0