PT-2022-7022 · Git+9 · Git+9
Cory Snider
·
Published
2021-08-05
·
Updated
2025-09-29
·
CVE-2022-39253
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Git versions prior to 2.30.6
Git versions prior to 2.31.5
Git versions prior to 2.32.4
Git versions prior to 2.33.5
Git versions prior to 2.34.5
Git versions prior to 2.35.5
Git versions prior to 2.36.3
Git versions prior to 2.37.4
Description
The issue is related to the exposure of sensitive information to a malicious actor when performing a local clone of a Git repository. A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the
--recurse-submodules option. Git does not create symbolic links in the $GIT DIR/objects directory.Recommendations
For versions prior to 2.30.6, update to version 2.30.6 or later.
For versions prior to 2.31.5, update to version 2.31.5 or later.
For versions prior to 2.32.4, update to version 2.32.4 or later.
For versions prior to 2.33.5, update to version 2.33.5 or later.
For versions prior to 2.34.5, update to version 2.34.5 or later.
For versions prior to 2.35.5, update to version 2.35.5 or later.
For versions prior to 2.36.3, update to version 2.36.3 or later.
For versions prior to 2.37.4, update to version 2.37.4 or later.
As a temporary workaround, avoid cloning untrusted repositories using the
--local optimization when on a shared machine, either by passing the --no-local option to git clone or cloning from a URL that uses the file:// scheme. Alternatively, avoid cloning repositories from untrusted sources with --recurse-submodules or run git config --global protocol.file.allow user.Exploit
Fix
Link Following
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Git
Linuxmint
Apple Macos
Red Hat
Suse
Ubuntu