Skip to content
OpenAdvisories
High USN-6050-2 2 CVEs

git vulnerabilities

Published May 17, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-6050-1 fixed several vulnerabilities in Git. This update provides
the corresponding updates for CVE-2023-25652 and CVE-2023-29007 on
Ubuntu 16.04 LTS.

Original advisory details:

It was discovered that Git incorrectly handled certain commands.
An attacker could possibly use this issue to overwrite paths.
(CVE-2023-25652)

André Baptista and Vítor Pinho discovered that Git incorrectly handled
certain configurations. An attacker could possibly use this issue
to achieve arbitrary configuration injection. (CVE-2023-29007)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS git 1:2.7.4-0ubuntu1.10+esm7

Vulnerabilities 2

  • High 7.5
    CVE-2023-25652 EPSS 52%

    "git apply --reject" partially-controlled arbitrary file write

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…

    git git git git Debian Ubuntu Alpine Wolfi
  • High 7.0
    CVE-2023-29007 Public exploit

    Arbitrary configuration injection via `git submodule deinit`

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…

    git git git git Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2023-25652
  • report
    https://ubuntu.com/security/CVE-2023-29007