Log in Start free

Vulnerability · Published Apr 25, 2023 · Assigned by GitHub_M

CVE-2023-25652"git apply --reject" partially-controlled arbitrary file write

High 7.5

In plain English

A high-severity path traversal in git from git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 51.9% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)51.9%top 1.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8git2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-all2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-all2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-core2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-core2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-core-doc2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-core-doc2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-credential-libsecret2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-credential-libsecret2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-daemon2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-daemon2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-email2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-email2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-gui2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-gui2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-instaweb2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-instaweb2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-subtree2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-subtree2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-svn2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-svn2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8gitk2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9gitk2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8gitweb2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9gitweb2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8perl-Git2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9perl-Git2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8perl-Git-SVN2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9perl-Git-SVN2.39.3-1.el9_2ALSA-2023:3245
Alpine:v3.20git2.40.1-r0ALPINE-CVE-2023-25652
Alpine:v3.21git2.40.1-r0ALPINE-CVE-2023-25652
Alpine:v3.22git2.40.1-r0ALPINE-CVE-2023-25652
Alpine:v3.23git2.40.1-r0ALPINE-CVE-2023-25652
Alpine:v3.24git2.40.1-r0ALPINE-CVE-2023-25652
Debian:12git1:2.39.5-0+deb12u1DSA-5769-1
Debian:12git1:2.39.5-0+deb12u1DEBIAN-CVE-2023-25652
Debian:13git1:2.40.1-1DEBIAN-CVE-2023-25652
Debian:14git1:2.40.1-1DEBIAN-CVE-2023-25652
Rocky Linux:8git0:2.39.3-1.el8_8RLSA-2023:3246
Ubuntu:22.04:LTSgit1:2.34.1-1ubuntu1.9UBUNTU-CVE-2023-25652
Ubuntu:22.04:LTSgit1:2.34.1-1ubuntu1.9USN-6050-1

Affected products (as reported)

VendorProductVersions
git git < 2.30.9>= 2.31.0, < 2.31.8>= 2.32.0, < 2.32.7>= 2.33.0, < 2.33.8>= 2.34.0, < 2.34.8>= 2.35.0, < 2.35.8>= 2.36.0, < 2.36.6>= 2.37.0, < 2.37.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References