Skip to content
OpenAdvisories
High ALSA-2023:3245 5 CVEs

Important: git security update

Published May 22, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

* git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (CVE-2023-25652)
* git: arbitrary configuration injection when renaming or deleting a section from a configuration file (CVE-2023-29007)
* git: data exfiltration with maliciously crafted repository (CVE-2023-22490)
* git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)
* git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 15

ReleasePackageFixed in
AlmaLinux · 9 git 2.39.3-1.el9_2
AlmaLinux · 9 git-all 2.39.3-1.el9_2
AlmaLinux · 9 git-core 2.39.3-1.el9_2
AlmaLinux · 9 git-core-doc 2.39.3-1.el9_2
AlmaLinux · 9 git-credential-libsecret 2.39.3-1.el9_2
AlmaLinux · 9 git-daemon 2.39.3-1.el9_2
AlmaLinux · 9 git-email 2.39.3-1.el9_2
AlmaLinux · 9 git-gui 2.39.3-1.el9_2
AlmaLinux · 9 git-instaweb 2.39.3-1.el9_2
AlmaLinux · 9 git-subtree 2.39.3-1.el9_2
AlmaLinux · 9 git-svn 2.39.3-1.el9_2
AlmaLinux · 9 gitk 2.39.3-1.el9_2
AlmaLinux · 9 gitweb 2.39.3-1.el9_2
AlmaLinux · 9 perl-Git 2.39.3-1.el9_2
AlmaLinux · 9 perl-Git-SVN 2.39.3-1.el9_2

Vulnerabilities 5

  • High 7.5
    CVE-2023-25652 EPSS 52%

    "git apply --reject" partially-controlled arbitrary file write

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…

    git git git git Debian Ubuntu Alpine Wolfi
  • High 7.0
    CVE-2023-29007 Public exploit

    Arbitrary configuration injection via `git submodule deinit`

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…

    git git git git Debian Ubuntu Alpine Wolfi
  • Medium 6.2
    CVE-2023-23946 Public exploit

    Git's `git apply` overwriting paths outside the working tree

    Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten…

    git git git git Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2023-22490 Public exploit

    Git vulnerable to local clone-based data exfiltration with non-local transports

    Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local…

    git git git git Debian Ubuntu Alpine Wolfi
  • Low 3.3
    CVE-2023-25815

    Git looks for localized messages in the wrong place

    In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…

    git-for-windows git git git Debian Ubuntu Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-22490
  • report
    https://access.redhat.com/security/cve/CVE-2023-23946
  • report
    https://access.redhat.com/security/cve/CVE-2023-25652
  • report
    https://access.redhat.com/security/cve/CVE-2023-25815
  • report
    https://access.redhat.com/security/cve/CVE-2023-29007
  • report
    https://bugzilla.redhat.com/2168160
  • report
    https://bugzilla.redhat.com/2168161
  • report
    https://bugzilla.redhat.com/2188333
  • report
    https://bugzilla.redhat.com/2188337
  • report
    https://bugzilla.redhat.com/2188338
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-3245.html