CVE-2022-39260

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.30.6 Git versions prior to 2.31.5 Git versions prior to 2.32.4 Git versions prior to 2.33.5 Git versions prior to 2.34.5 Git versions prior to 2.35.5 Git versions prior to 2.36.3 Git versions prior to 2.37.4

Description The issue is related to the function that splits the command arguments into an array in Git's git shell, which improperly uses an int to represent the number of entries in the array. This allows a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes and potentially gaining remote code execution on a victim machine. The victim must first allow access to git shell as a login shell to be vulnerable to this attack.

Recommendations Upgrade to version 2.30.6 or later for Git versions prior to 2.30.6. Upgrade to version 2.31.5 or later for Git versions prior to 2.31.5. Upgrade to version 2.32.4 or later for Git versions prior to 2.32.4. Upgrade to version 2.33.5 or later for Git versions prior to 2.33.5. Upgrade to version 2.34.5 or later for Git versions prior to 2.34.5. Upgrade to version 2.35.5 or later for Git versions prior to 2.35.5. Upgrade to version 2.36.3 or later for Git versions prior to 2.36.3. Upgrade to version 2.37.4 or later for Git versions prior to 2.37.4. As a temporary workaround, consider disabling git shell access via remote logins.