PT-2022-7287 · Ruby-Git+3 · Ruby-Git+3

Yuki Kokubun · Published 2022-01-05 · Updated 2025-12-15 · CVE-2022-47318

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ruby-git versions prior to v1.13.0

Description The issue is related to incorrect code generation management in the Ruby/Git library, allowing a remote authenticated attacker to execute arbitrary Ruby code. This can be achieved by having a user load a repository containing a specially crafted filename to the product.

Recommendations For versions prior to v1.13.0, update to version v1.13.0 or later to resolve the issue. As a temporary workaround, consider restricting access to repositories that may contain specially crafted filenames until the update is applied.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2023-2040

ALT-PU-2023-4279

ALT-PU-2024-7826

BDU:2024-02286

CVE-2022-47318

DLA-3303-1

DLA-4406-1

GHSA-PPHF-GFRM-V32R

MGASA-2023-0097

RHSA-2023:5931

RHSA-2023:5979

RHSA-2023:5980

RHSA-2023:6818

RLSA-2023:6818

Affected Products

Alt Linux

Debian

Rocky Linux

Ruby-Git

References · 26

• https://github.com/ruby-git/ruby-git/pull/602 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47318 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47318 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47318 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pphf-gfrm-v32r · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4KPFLSZPUM7APWVBRM5DCAY5OUVQBF4K · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3303 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KPFLSZPUM7APWVBRM5DCAY5OUVQBF4K · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47318 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0097 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4406-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47318 · Security Note
• https://errata.rockylinux.org/RLSA-2023:6818 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3303-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-47318 · Vendor Advisory