CVE-2023-29012: High severity git for windows vulnerability
Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed doskey.exe would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory.
Other sources
GitHub: CVE-2023-29012 Git CMD erroneously executes doskey.exe in current directory, if it exists
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29012?
The severity of CVE-2023-29012 is high.
Which software is affected by CVE-2023-29012?
Visual Studio 2022 versions 17.2, 17.4, and 17.0, as well as Visual Studio 2019 version 16.11 are affected by CVE-2023-29012.
How can I fix CVE-2023-29012 for Visual Studio 2022 version 17.2?
You can download the patch for Visual Studio 2022 version 17.2 from the following URL: https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.2
How can I fix CVE-2023-29012 for Visual Studio 2022 version 17.4?
You can download the patch for Visual Studio 2022 version 17.4 from the following URL: https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.4
How can I fix CVE-2023-29012 for Visual Studio 2019 version 16.11?
You can download the patch for Visual Studio 2019 version 16.11 from the following URL: https://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11