CVE-2023-25652: "git apply --reject" partially-controlled arbitrary file write

Published Apr 20, 2023
·
Updated

A vulnerability was found in Git. This security flaw occurs when feeding specially crafted input to git apply --reject; a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch.

Other sources

CVE-2023-25652 By feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch).

— Red Hat

Git could allow a remote attacker to bypass security restrictions. By feeding specially crafted input to git apply --reject, an attacker could exploit this vulnerability to overwrite a path outside the working tree.

— IBM

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using git apply with --reject when applying patches from an untrusted source. Use git apply --stat to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the .rej file exists.

GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write

Affected Software

29 affected componentsFixes available
redhat/git<0:1.8.3.1-25.el7_9
0:1.8.3.1-25.el7_9
redhat/git<0:2.39.3-1.el8_8
0:2.39.3-1.el8_8
redhat/git<0:2.18.4-3.el8_1
0:2.18.4-3.el8_1
redhat/git<0:2.18.4-4.el8_2
0:2.18.4-4.el8_2
redhat/git<0:2.27.0-4.el8_4
0:2.27.0-4.el8_4
redhat/git<0:2.31.1-4.el8_6
0:2.31.1-4.el8_6
redhat/git<0:2.39.3-1.el9_2
0:2.39.3-1.el9_2
redhat/git<0:2.31.1-5.el9_0
0:2.31.1-5.el9_0
redhat/rh-git227-git<0:2.27.0-6.el7
0:2.27.0-6.el7
Microsoft Visual Studio 2019 (includes 16.0 - 16.10)=16.11
Patch available
Microsoft Visual Studio 2017 (includes 15.0 - 15.8)=15.9
Patch available
IBM QRadar SIEM<=7.5.0 - 7.5.0 UP6
git-scm Git<2.30.9
git-scm Git>=2.31.0<2.31.8
git-scm Git>=2.32.0<2.32.7
git-scm Git>=2.33.0<2.33.8
git-scm Git>=2.34.0<2.34.8
git-scm Git>=2.35.0<2.35.8
git-scm Git>=2.36.0<2.36.6
git-scm Git>=2.37.0<2.37.7
git-scm Git>=2.38.0<2.38.5
git-scm Git>=2.39.0<2.39.3
git-scm Git=2.40.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Microsoft Visual Studio 2022=17.2
Patch available
Microsoft Visual Studio 2022=17.6
Patch available
Microsoft Visual Studio 2022=17.0
Patch available
debian/git
1:2.39.5-0+deb12u31:2.39.5-0+deb12u21:2.47.3-0+deb13u11:2.53.0-11:2.55.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:1.8.3.1-25.el7_9
  2. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.39.3-1.el8_8
  3. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.18.4-3.el8_1
  4. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.18.4-4.el8_2
  5. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.27.0-4.el8_4
  6. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.31.1-4.el8_6
  7. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.39.3-1.el9_2
  8. Upgrade

    Upgrade redhat/git to a version that resolves this vulnerability.

    Fixed in 0:2.31.1-5.el9_0
  9. Upgrade

    Upgrade redhat/rh-git227-git to a version that resolves this vulnerability.

    Fixed in 0:2.27.0-6.el7
  10. Upgrade

    Upgrade debian/git to a version that resolves this vulnerability.

    Fixed in 1:2.39.5-0+deb12u3Fixed in 1:2.39.5-0+deb12u2Fixed in 1:2.47.3-0+deb13u1Fixed in 1:2.53.0-1Fixed in 1:2.55.0-1
  11. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.30.9
  12. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.31.8
  13. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.32.7
  14. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.33.8
  15. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.34.8
  16. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.35.8
  17. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.36.6
  18. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.37.7
  19. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.38.5
  20. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.39.3
  21. Upgrade

    Upgrade git to a version that resolves this vulnerability.

    Fixed in 2.40.1
  22. Compensating control

    Avoid using git apply with --reject when applying patches from an untrusted source.

  23. Compensating control

    Use git apply --stat to inspect a patch before applying it; avoid applying patches that create a conflict where a link corresponding to the *.rej file exists.

Event History

Apr 20, 2023
Data Sourced
via Red Hat·01:46 PM
DescriptionSeverityAffected Software
Apr 25, 2023
CVE Published
12:00 AM
CVE Published
via MITRE·07:17 PM
Data Sourced
via MITRE·07:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 13, 2023
Data Sourced
07:00 AM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2023-25652?

CVE-2023-25652 refers to a vulnerability in Git that allows an attacker to overwrite a file outside of the working tree with partially controlled contents.

2

How severe is CVE-2023-25652?

CVE-2023-25652 has a severity rating of high.

3

Which versions of Git are affected by CVE-2023-25652?

The vulnerability affects Git versions prior to 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1.

4

How can I fix CVE-2023-25652?

To fix CVE-2023-25652, you should update Git to version 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, or 2.40.1.

5

Where can I find more information about CVE-2023-25652?

You can find more information about CVE-2023-25652 at the following references: [Reference 1](https://access.redhat.com/security/cve/CVE-2023-25652), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2189765), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2189766).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203