CVE-2022-39253: Git - Exposure of Sensitive Information
Summary
CVE-2023-22490: Git is an open source, scalable, distributed revision control system. Affects git across 3 version ranges.
< 2.30.6-r0
>= 853373155dce195a91e6e41a58c8b8e5c5a94652, < 2d2fc8ce733f75f497faabab85c273658c9a5f81
< abd4d67ab0f84fff703fa14d9eebfd287b42daeb
Fixed in 2.30.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is an open source, scalable, distributed revision control system. It is widely used for version control and collaboration in software development projects. Git allows multiple developers to work on the same codebase simultaneously, tracking changes and managing different versions of files. It is a critical component in modern software development workflows.
Vulnerability Detail
The vulnerability, identified as CVE-2022-39253, affects versions of Git prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4. When performing a local clone, Git copies the contents of the source's $GIT_DIR/objects directory into the destination. This process involves creating hardlinks or copying the contents. However, Git does not create symbolic links in the $GIT_DIR/objects directory. A malicious actor can exploit this behavior by convincing a victim to clone a repository with a symbolic link pointing to sensitive information on the victim's machine. This can be achieved by having the victim clone a malicious repository on the same machine or cloning a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the --recurse-submodules option. The vulnerability exposes the victim's sensitive information to the attacker.
How To Fix
Minimum fixed version
2.30.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk of this vulnerability, users can follow these workarounds:
- Avoid cloning untrusted repositories using the
--localoptimization when on a shared machine. This can be done by passing the--no-localoption togit cloneor cloning from a URL that uses thefile://scheme. - Alternatively, avoid cloning repositories from untrusted sources with the
--recurse-submodulesoption. - Run the command
git config --global protocol.file.allow userto allow cloning repositories with symbolic links.
Conclusion
The vulnerability in Git exposes sensitive information to malicious actors through the cloning process. It is crucial to update Git to the patched versions to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is an open source, distributed revision control system used for version control and collaboration in software development projects.
The vulnerability allows a malicious actor to expose sensitive information on a victim's machine by convincing them to clone a repository with a symbolic link pointing to the sensitive data.
To fix the vulnerability, update your Git installation to versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, or 2.37.4.
Yes, you can avoid cloning untrusted repositories using the --local optimization on shared machines, or avoid cloning repositories from untrusted sources with the --recurse-submodules option. Another workaround is to run the command git config --global protocol.file.allow user.
There are alternative version control systems available, but it is recommended to update Git to the patched versions to ensure the latest security fixes are applied.
Related vulnerabilities
Recent vulnerabilities recorded for git.
