Privilege Escalation Vulnerability in Git
Summary
CVE-2022-29187: Git is a distributed revision control system. Affects git across 3 version ranges.
< 2.30.5-r0
>= 518ccba2352ce721cabbbf2933869c3c3313d1c3, < 9a2f22d016b61018668f8dd2f53faf92c40c6bb8
>= cb95038137e9e66fc6a6b4a0e8db62bcc521b709, < 88b7be68a4bf9f39b84ed438d8d776c0d752b316
Fixed in 2.30.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Git is a distributed revision control system used for tracking changes in source code during software development. It allows multiple developers to collaborate on a project efficiently. Git is widely used and supports various platforms. However, it is susceptible to privilege escalation, which can lead to unauthorized access and control over the system.
Vulnerability Detail
The vulnerability, identified as CVE-2022-29187, affects Git versions prior to 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5. It allows an attacker to escalate their privileges on all platforms. An unsuspecting user, even if not running Git as root or an Administrator, can still be affected when navigating into a shared tmp directory owned by them. In such a scenario, an attacker can create a malicious Git repository, potentially compromising the system. The issue has been patched in the mentioned versions of Git.
How To Fix
Minimum fixed version
2.30.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to avoid running Git as root or an Administrator. If running Git with elevated privileges is necessary, it is advised to minimize its usage and restrict access to trusted users only. Additionally, existing repositories in shared tmp directories owned by non-root users should be removed, and new repositories should be created with root privileges to prevent future attacks.
Conclusion
The privilege escalation vulnerability in Git (CVE-2022-29187) can lead to unauthorized access and control over the system. It is crucial to update Git to the patched versions and avoid running it with elevated privileges unless necessary. Removing existing repositories in shared tmp directories owned by non-root users and creating new repositories with root privileges can further mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is a distributed revision control system used for tracking changes in source code during software development. It allows multiple developers to collaborate on a project efficiently.
The vulnerability affects Git versions prior to 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5.
To fix this vulnerability, update Git to version 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, or 2.30.5. Avoid running Git as root or an Administrator unless necessary.
Yes, an unsuspecting user can still be affected if they navigate into a shared tmp directory owned by them, where an attacker can create a malicious Git repository.
While a generic workaround is not possible, hardening the system can be done by removing any existing repositories in shared tmp directories owned by non-root users and creating new repositories with root privileges.
Related vulnerabilities
Recent vulnerabilities recorded for git.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
