Sensitive Information Exposure in Git Package - CVE-2022-39253
Summary
ALPINE-CVE-2022-39253: Git is an open source, scalable, distributed revision control system. Affects git versions < 2.30.6-r0. Fixed in 2.30.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is an open source, scalable, distributed revision control system widely used for tracking changes in source code during software development. It allows multiple developers to work on a project simultaneously, providing features such as branching, merging, and version history. However, certain versions of Git are vulnerable to a security issue that can expose sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2022-39253, affects Git versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4. It arises when a local clone operation is performed, where Git copies the contents of the source's $GIT_DIR/objects directory into the destination. If a malicious actor convinces a victim to clone a repository containing a symbolic link pointing to sensitive information on the victim's machine, this information could be exposed. The vulnerability can be exploited either by cloning a malicious repository directly or through a submodule.
How To Fix
Minimum fixed version
2.30.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Avoid cloning untrusted repositories using the --local optimization on shared machines. You can do this by passing the --no-local option to the git clone command or by cloning from a URL that uses the file:// scheme. Additionally, avoid cloning repositories from untrusted sources with --recurse-submodules or run the command 'git config --global protocol.file.allow user'.
Conclusion
CVE-2022-39253 is a significant vulnerability in Git that can lead to the exposure of sensitive information. Users are advised to update to the latest patched versions of Git and follow recommended workarounds to mitigate risks.
See every vulnerability recorded for git →
FAQ
CVE-2022-39253 is a vulnerability in Git that can expose sensitive information during local clone operations.
Affected versions include those prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability.
As a temporary measure, avoid cloning untrusted repositories with the --local optimization and consider using the --no-local option.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
