CVE-2023-29007

Name
CVE-2023-29007
Description
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844
MISC https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4
MISC https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.36.0 < 2.36.5
cpe:2.3:a:git-scm:git:2.40.0:*:*:*:*:*:*:* git == None == 2.40.0
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.39.0 < 2.39.3
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.38.0 < 2.38.5
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.37.0 < 2.37.7
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.35.0 < 2.35.8
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.34.0 < 2.34.8
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.33.0 < 2.33.8
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.32.0 < 2.32.7
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.31.0 < 2.31.8
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= None < 2.30.9

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
git 3.17-main 2.38.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.16-main 2.36.6-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.15-main 2.34.8-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.14-main 2.32.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.18-main 2.40.1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed