PT-2023-1979
CVE-2023-22490
·
Publicado
2023-02-14
·
Atualizado
2026-09-30
Descrição por
CVSS 3.1
5.5
MédiaMétricasAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Git versions prior to 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8
Description
The issue is related to Git's handling of symbolic links when using local clone optimization. Although Git aborts local clones if the source
$GIT DIR/objects directory contains symbolic links, the objects directory itself can still be a symbolic link. This can be exploited to include arbitrary files from known paths on the victim's filesystem within a malicious repository's working copy, allowing for data exfiltration.Recommendations
To resolve the issue for each affected version, upgrade to version 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, or 2.30.8.
If upgrading is impractical, consider the following workarounds:
- Avoid cloning repositories from untrusted sources with
--recurse-submodules. - Clone repositories without recursively cloning their submodules, and instead run
git submodule updateat each layer. - Before doing so, inspect each new
.gitmodulesfile to ensure that it does not contain suspicious module URLs.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾