Skip to content
OpenAdvisories
High USN-5686-1 2 CVEs

git vulnerabilities

Published Oct 18, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Cory Snider discovered that Git incorrectly handled certain symbolic links.
An attacker could possibly use this issue to cause an unexpected behaviour.
(CVE-2022-39253)

Kevin Backhouse discovered that Git incorrectly handled certain command strings.
An attacker could possibly use this issue to arbitrary code execution.
(CVE-2022-39260)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS git 1:2.17.1-1ubuntu0.13
Ubuntu · 20.04 LTS 20.04:LTS git 1:2.25.1-1ubuntu3.6
Ubuntu · 22.04 LTS 22.04:LTS git 1:2.34.1-1ubuntu1.5

Vulnerabilities 2

  • High 8.5
    CVE-2022-39260

    Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

    Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and…

    git git git git Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2022-39253 Public exploit

    Git subject to exposure of sensitive information via local clone of symbolic links

    Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (wh…

    git git git git Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2022-39253
  • report
    https://ubuntu.com/security/CVE-2022-39260