Skip to content
OpenAdvisories
Critical USN-5810-1 2 CVEs

git vulnerabilities

Published Jan 17, 2023 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain
gitattributes. An attacker could possibly use this issue to cause a crash
or execute arbitrary code. (CVE-2022-23521)

Joern Schneeweisz discovered that Git incorrectly handled certain commands.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-41903)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS git 1:2.17.1-1ubuntu0.14
Ubuntu · 20.04 LTS 20.04:LTS git 1:2.25.1-1ubuntu3.7
Ubuntu · 22.04 LTS 22.04:LTS git 1:2.34.1-1ubuntu1.6

Vulnerabilities 2

  • Critical 9.8
    CVE-2022-23521 EPSS 56%

    gitattributes parsing integer overflow in git

    Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes tha…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2022-41903 Public exploit EPSS 44%

    Integer overflow in `git archive`, `git log --format` leading to RCE in git

    Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, t…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2022-23521
  • report
    https://ubuntu.com/security/CVE-2022-41903