Critical Remote Code Execution Vulnerability in Git Package
Summary
ALPINE-CVE-2022-39260: Git is an open source, scalable, distributed revision control system. Affects git versions < 2.30.6-r0. Fixed in 2.30.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is an open-source, scalable, distributed revision control system widely used for source code management. It allows multiple developers to work on a project simultaneously, tracking changes and facilitating collaboration. The Git shell provides a restricted login shell for executing Git commands over SSH. However, certain versions of Git are vulnerable to a severe security flaw that can lead to remote code execution if exploited.
Vulnerability Detail
The vulnerability arises from improper handling of command arguments in Git's shell functionality. Specifically, an integer is used to represent the number of entries in an array, which can be intentionally overflowed by a malicious actor. This overflow can lead to arbitrary heap writes, allowing the attacker to execute arbitrary code on the victim's machine. The affected versions include those prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4. To be vulnerable, the victim must allow access to git shell as a login shell.
How To Fix
Minimum fixed version
2.30.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a short-term workaround, it is advisable to disable git shell access via remote logins. This can be done by modifying the SSH configuration to restrict access to the Git shell for users.
Conclusion
In summary, a critical vulnerability in the Git package allows for remote code execution due to improper handling of command arguments. Users are strongly advised to update to the latest patched versions to mitigate this risk. Additionally, disabling git shell access can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for git →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a critical level of severity.
Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update Git immediately, disable git shell access via remote logins as a temporary measure.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to gain control over the victim's machine.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
