Skip to content
OpenAdvisories
Medium USN-5871-1 2 CVEs

git vulnerabilities

Published Feb 14, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Git incorrectly handled certain repositories.
An attacker could use this issue to make Git uses its local
clone optimization even when using a non-local transport.
(CVE-2023-22490)

Joern Schneeweisz discovered that Git incorrectly handled certain commands.
An attacker could possibly use this issue to overwrite a patch outside
the working tree. (CVE-2023-23946)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS git 1:2.17.1-1ubuntu0.16
Ubuntu · 20.04 LTS 20.04:LTS git 1:2.25.1-1ubuntu3.10
Ubuntu · 22.04 LTS 22.04:LTS git 1:2.34.1-1ubuntu1.8
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS git 1:2.7.4-0ubuntu1.10+esm5

Vulnerabilities 2

  • Medium 6.2
    CVE-2023-23946 Public exploit

    Git's `git apply` overwriting paths outside the working tree

    Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten…

    git git git git Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2023-22490 Public exploit

    Git vulnerable to local clone-based data exfiltration with non-local transports

    Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local…

    git git git git Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2023-22490
  • report
    https://ubuntu.com/security/CVE-2023-23946