Skip to content
OpenAdvisories
Critical USN-5810-3 2 CVEs

git vulnerabilities

Published Feb 7, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-5810-1 fixed several vulnerabilities in Git. This update provides
the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain
gitattributes. An attacker could possibly use this issue to cause a crash
or execute arbitrary code. (CVE-2022-23521)

Joern Schneeweisz discovered that Git incorrectly handled certain commands.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-41903)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS git 1:2.7.4-0ubuntu1.10+esm4

Vulnerabilities 2

  • Critical 9.8
    CVE-2022-23521 EPSS 56%

    gitattributes parsing integer overflow in git

    Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes tha…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2022-41903 Public exploit EPSS 44%

    Integer overflow in `git archive`, `git log --format` leading to RCE in git

    Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, t…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2022-23521
  • report
    https://ubuntu.com/security/CVE-2022-41903