CVE-2023-22490: GitLab Critical Security Release: 15.8.2, 15.7.7 and 15.6.8
A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GITDIR/objects directory contains symbolic links (CVE-2022-39253), the objects directory may still be a symbolic link.
Other sources
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GITDIR/objects directory contains symbolic links, the objects directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.
A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with --recurse-submodules. Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update at each layer. Before doing so, inspect each new .gitmodules file to ensure that it does not contain suspicious module URLs.
— MITRE
Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GITDIR/objects directory contains symbolic links (c.f., CVE-2022-39253), the objects directory itself may still be a symbolic link.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 0:2.39.3-1.el8_8 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 0:2.39.3-1.el9_2 - Upgrade
Upgrade
Gitto a version that resolves this vulnerability.Fixed in 2.39.2 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 15.8.2 - Compensating control
Avoid cloning repositories from untrusted sources with --recurse-submodules; clone without recursively cloning submodules, run git submodule update at each layer, and inspect each new .gitmodules file for suspicious module URLs before proceeding.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Git vulnerability?
The vulnerability ID for this Git vulnerability is CVE-2023-22490.
What is the severity level of CVE-2023-22490?
The severity level of CVE-2023-22490 is medium.
How can Git be tricked into using its local clone optimization even when using a non-local transport?
Git can be tricked into using its local clone optimization even when using a non-local transport by using a specially-crafted repository.
What versions of Git are affected by this vulnerability?
Versions of Git prior to 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 are affected by this vulnerability.
How can I fix CVE-2023-22490?
To fix CVE-2023-22490, update Git to version 2.39.3-1.el8_8 or 2.39.3-1.el9_2.