CVE-2022-39253 — Git subject to exposure of sensitive information via local clone of symbolic links

Description

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.

Affected products

Vendor	Product	Affected	Fixed
git	git	< 2.30.6, < 2.31.5, < 2.32.4, < 2.33.5, < 2.34.5, < 2.35.5, < 2.36.3, < 2.37.4	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	git	1:2.38.1-1	—
Debian 13	git	1:2.38.1-1	—
Debian 12	git	1:2.38.1-1	—
Debian 11	git	1:2.30.2-1+deb11u1	DSA-5332-1
Debian 10	git	1:2.20.1-2+deb10u5	DLA-3239-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	git	1:2.34.1-1ubuntu1.5	USN-5686-1
Ubuntu 20.04 LTS	git	1:2.25.1-1ubuntu3.6	USN-5686-1
Ubuntu 18.04 LTS	git	1:2.17.1-1ubuntu0.13	USN-5686-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	git	1:2.7.4-0ubuntu1.10+esm6	USN-5686-4

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	git +14	2.39.1-1.el9	RHSA-2023:2319
RHEL 8	git +14	2.39.1-1.el8	RHSA-2023:2859

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.6 EUS	git +14	2.31.8-1.el8_6	RHSA-2024:0407

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	git +14	2.39.1-1.el9	ALSA-2023:2319
AlmaLinux 8	git +14	2.39.1-1.el8	ALSA-2023:2859

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	git	2.35.3-150300.10.18.1	SUSE-SU-2022:3931-1
SLES 15 SP3	git	2.35.3-150300.10.18.1	SUSE-SU-2022:3931-1
SLES 15 SP2	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES 15 SP1	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES 12 SP5	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1

Show 8 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP2	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES for SAP 15 SP1	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES for SAP 12 SP5	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1
SLE HPC 15 SP2	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLE HPC 15 SP1	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SUSE OpenStack Cloud 8	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1
SUSE HPE Helion OpenStack 8	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1
SUSE Enterprise Storage 7	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	docker-compose	2.12.2-1.1	openSUSE-SU-2024:12430-1
openSUSE Tumbleweed	git	2.38.1-1.1	openSUSE-SU-2024:12487-1
openSUSE Tumbleweed	perl-Git-Repository	1.326.0-1.1	openSUSE-SU-2026:10987-1
openSUSE Tumbleweed	reuse	1.1.2-1.1	openSUSE-SU-2024:12851-1
openSUSE Leap 15.4	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1, SUSE-SU-2022:3931-1
openSUSE Leap 15.3	git	2.35.3-150300.10.18.1	SUSE-SU-2022:3931-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	docker	20.10.20-r0	—
Alpine v3.24	docker-cli-compose	2.12.1-r0	—
Alpine v3.24	git	2.38.1-r0	—
Alpine v3.23	docker	20.10.20-r0	—
Alpine v3.23	docker-cli-compose	2.12.1-r0	—
Alpine v3.23	git	2.38.1-r0	—
Alpine v3.22	docker	20.10.20-r0	—
Alpine v3.22	docker-cli-compose	2.12.1-r0	—
Alpine v3.22	git	2.38.1-r0	—
Alpine v3.21	docker	20.10.20-r0	—
Alpine v3.21	docker-cli-compose	2.12.1-r0	—
Alpine v3.21	git	2.38.1-r0	—
Alpine v3.20	docker	20.10.20-r0	—
Alpine v3.20	docker-cli-compose	2.12.1-r0	—
Alpine v3.20	git	2.38.1-r0	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	docker	20.10.20-r0	—
Alpine v3.19	docker-cli-compose	2.12.1-r0	—
Alpine v3.19	git	2.38.1-r0	—
Alpine v3.18	docker	20.10.20-r0	—
Alpine v3.18	docker-cli-compose	2.12.1-r0	—
Alpine v3.18	git	2.38.1-r0	—
Alpine v3.17	docker	20.10.20-r0	—
Alpine v3.17	docker-cli-compose	2.12.1-r0	—
Alpine v3.17	git	2.38.1-r0	—
Alpine v3.16	docker	20.10.20-r0	—
Alpine v3.16	docker-cli-compose	2.12.1-r0	—
Alpine v3.16	git	2.36.3-r0	—
Alpine v3.15	git	2.34.5-r0	—
Alpine v3.14	git	2.32.4-r0	—
Alpine v3.13	git	2.30.6-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	git +16	2.39.1-1.amzn2023.0.2	ALAS2023-2023-065
Amazon Linux 2	git +16	2.38.1-1.amzn2.0.1	ALAS2-2022-1886

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	git +14	2.39.1-1.el9	ELSA-2023-2319
Oracle Linux 8	git +14	2.39.1-1.el8	ELSA-2023-2859

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	git	2.38.1-r0	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

ssst0n3/docker-cve-2022-39253-poc ★ 10 · Dec 20, 2022
HiImDarwin/NetworkSecurityFinalProject ★ 0 · May 15, 2023

https://nvd.nist.gov/vuln/detail/CVE-2022-39253

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 25

ALSA-2023:2319 Moderate: git security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:2859 Moderate: git security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:0407 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:2859 Red Hat Security Advisory: git security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:2319 Red Hat Security Advisory: git security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-5686-4 git vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
WID-SEC-2022-1790 git: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 11, 2026
openSUSE-SU-2026:10987-1 perl-Git-Repository-1.326.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 10, 2026
DSA-5332-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3239-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
USN-5686-1 git vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
openSUSE-SU-2024:12430-1 docker-compose-2.12.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3931-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:0418-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12487-1 git-2.38.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
WID-SEC-2025-0794 Juniper Junos Space: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 4, 2025
VDE-2023-001 PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jun 5, 2025
openSUSE-SU-2024:12851-1 reuse-1.1.2-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
SUSE-SU-2022:4271-1 Security update for git SUSE / openSUSE Security Updates · May 2, 2025
ELSA-2023-2859 Moderate: git security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 23, 2023
WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
ELSA-2023-2319 Moderate: git security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
ALAS2023-2023-065 Important: git security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
ALAS2-2022-1886 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 6, 2022

References

https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85
FEDORA-2022-12790ca71a vendor-advisory
FEDORA-2022-8b58806840 vendor-advisory
https://support.apple.com/kb/HT213496
FEDORA-2022-53aadd995f vendor-advisory
20221107 APPLE-SA-2022-11-01-1 Xcode 14.1 mailing-list
FEDORA-2022-2c33bba286 vendor-advisory
FEDORA-2022-fb088df94c vendor-advisory
[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update mailing-list
[oss-security] 20230214 [Announce] Git 2.39.2 and friends mailing-list
GLSA-202312-15 vendor-advisory
[oss-security] 20240514 git: 5 vulnerabilities fixed mailing-list

CNA	v3.1	5.5
EUVD	v3.1	5.5