PT-2023-1979
CVE-2023-22490
·
Published
2023-02-14
·
Updated
2026-09-30
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Git versions prior to 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8
Description
The issue is related to Git's handling of symbolic links when using local clone optimization. Although Git aborts local clones if the source
$GIT DIR/objects directory contains symbolic links, the objects directory itself can still be a symbolic link. This can be exploited to include arbitrary files from known paths on the victim's filesystem within a malicious repository's working copy, allowing for data exfiltration.Recommendations
To resolve the issue for each affected version, upgrade to version 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, or 2.30.8.
If upgrading is impractical, consider the following workarounds:
- Avoid cloning repositories from untrusted sources with
--recurse-submodules. - Clone repositories without recursively cloning their submodules, and instead run
git submodule updateat each layer. - Before doing so, inspect each new
.gitmodulesfile to ensure that it does not contain suspicious module URLs.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾