PT-2023-1979
CVE-2023-22490
·
تاريخ النشر
2023-02-14
·
تاريخ التحديث
2026-09-30
الوصف من
CVSS 3.1
5.5
متوسطةالمقاييسAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Git versions prior to 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8
Description
The issue is related to Git's handling of symbolic links when using local clone optimization. Although Git aborts local clones if the source
$GIT DIR/objects directory contains symbolic links, the objects directory itself can still be a symbolic link. This can be exploited to include arbitrary files from known paths on the victim's filesystem within a malicious repository's working copy, allowing for data exfiltration.Recommendations
To resolve the issue for each affected version, upgrade to version 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, or 2.30.8.
If upgrading is impractical, consider the following workarounds:
- Avoid cloning repositories from untrusted sources with
--recurse-submodules. - Clone repositories without recursively cloning their submodules, and instead run
git submodule updateat each layer. - Before doing so, inspect each new
.gitmodulesfile to ensure that it does not contain suspicious module URLs.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾