Log in Start free

Vulnerability · Published Apr 25, 2023 · Assigned by GitHub_M

CVE-2023-29007Arbitrary configuration injection via `git submodule deinit`

High 7.0

In plain English

A high-severity injection in git from git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)5.6%top 7.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8git2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-all2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-all2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-core2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-core2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-core-doc2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-core-doc2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-credential-libsecret2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-credential-libsecret2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-daemon2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-daemon2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-email2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-email2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-gui2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-gui2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-instaweb2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-instaweb2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-subtree2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-subtree2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8git-svn2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9git-svn2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8gitk2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9gitk2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8gitweb2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9gitweb2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8perl-Git2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9perl-Git2.39.3-1.el9_2ALSA-2023:3245
AlmaLinux:8perl-Git-SVN2.39.3-1.el8_8ALSA-2023:3246
AlmaLinux:9perl-Git-SVN2.39.3-1.el9_2ALSA-2023:3245
Alpine:v3.20git2.40.1-r0ALPINE-CVE-2023-29007
Alpine:v3.21git2.40.1-r0ALPINE-CVE-2023-29007
Alpine:v3.22git2.40.1-r0ALPINE-CVE-2023-29007
Alpine:v3.23git2.40.1-r0ALPINE-CVE-2023-29007
Alpine:v3.24git2.40.1-r0ALPINE-CVE-2023-29007
Debian:12git1:2.39.5-0+deb12u1DSA-5769-1
Debian:12git1:2.39.5-0+deb12u1DEBIAN-CVE-2023-29007
Debian:13git1:2.40.1-1DEBIAN-CVE-2023-29007
Debian:14git1:2.40.1-1DEBIAN-CVE-2023-29007
Rocky Linux:8git0:2.39.3-1.el8_8RLSA-2023:3246
Ubuntu:22.04:LTSgit1:2.34.1-1ubuntu1.9UBUNTU-CVE-2023-29007
Ubuntu:22.04:LTSgit1:2.34.1-1ubuntu1.9USN-6050-1

Affected products (as reported)

VendorProductVersions
git git < 2.30.9>= 2.31.0, < 2.31.8>= 2.32.0, < 2.32.7>= 2.33.0, < 2.33.8>= 2.34.0, < 2.34.8>= 2.35.0, < 2.35.8>= 2.36.0, < 2.36.6>= 2.37.0, < 2.37.7

Weakness: CWE-74 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References