CVE-2022-23521

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.30.7

Description The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted .gitattributes file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both.

Recommendations For Git versions prior to 2.30.7, upgrade to a version published on or after 2023-01-17 to resolve the issue. As a temporary workaround, consider restricting the use of the .gitattributes file until a patch is applied. Avoid using huge numbers of path patterns, attributes for a single pattern, or huge declared attribute names in the .gitattributes file to minimize the risk of exploitation.