Critical Vulnerability in Git Package: Arbitrary Path Overwrite via --export-marks Option
Summary
ALPINE-CVE-2019-1348: An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Affects git versions < 2.22.2-r0. Fixed in 2.22.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that enables developers to track changes in source code during software development. It supports distributed, non-linear workflows and is known for its speed and efficiency. However, certain versions of Git are vulnerable to a security issue that allows attackers to exploit the --export-marks option, potentially leading to arbitrary path overwrites.
Vulnerability Detail
An issue was found in Git before versions 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, and 2.14.6. The vulnerability arises from the exposure of the --export-marks option through the in-stream command feature export-marks=..., which allows overwriting arbitrary paths. This could lead to unauthorized access or manipulation of files within the system, posing a significant risk to the integrity of the software and its data.
How To Fix
Minimum fixed version
2.22.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the --export-marks option in Git until the package is updated to a secure version. This can help mitigate the risk of exploitation while you work on applying the necessary updates.
Conclusion
The vulnerability in the Git package poses a significant risk due to the potential for arbitrary path overwrites. It is crucial for users to update their Git installations to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for git →
FAQ
The CVSS score of this vulnerability is 3.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions include all Git versions before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, and 2.14.6.
Exploitation of this vulnerability could lead to unauthorized access to files and manipulation of data, compromising the integrity of the software.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
