PT-2023-1321 · Git+10 · Git+10
Joern Schneeweisz
·
Published
2023-01-17
·
Updated
2026-02-13
·
CVE-2022-41903
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Git versions prior to 2.30.7
Description
The issue is related to an integer overflow in the
pretty.c::format and pad commit() function of the Git distributed revision control system. This overflow can result in arbitrary heap writes, potentially leading to arbitrary code execution. The vulnerability can be triggered directly by a user running a command that invokes the commit formatting machinery, such as git log --format=..., or indirectly through git archive via the export-subst mechanism.Recommendations
For versions prior to 2.30.7, upgrade to a version published on or after 2023-01-17.
If an upgrade is not possible, disable
git archive in untrusted repositories.
If git archive is exposed via git daemon, disable it by running git config --global daemon.uploadArch false.Exploit
Fix
Heap Based Buffer Overflow
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Git
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu