CVE-2022-39260 — Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

Description

Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.

Affected products

Vendor	Product	Affected	Fixed
git	git	< 2.30.6, > 2.31.0, < 2.31.5, > 2.32.0, < 2.32.4, > 2.33.0, < 2.33.5, > 2.34.0, < 2.34.5, > 2.34.0, < 2.35.5, > 2.35.0, < 2.36.3, > 2.37.0, < 2.37.4	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	git	1:2.38.1-1	—
Debian 13	git	1:2.38.1-1	—
Debian 12	git	1:2.38.1-1	—
Debian 11	git	1:2.30.2-1+deb11u1	DSA-5332-1
Debian 10	git	1:2.20.1-2+deb10u5	DLA-3239-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	git	1:2.34.1-1ubuntu1.5	USN-5686-1
Ubuntu 20.04 LTS	git	1:2.25.1-1ubuntu3.6	USN-5686-1
Ubuntu 18.04 LTS	git	1:2.17.1-1ubuntu0.13	USN-5686-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	git	1:2.7.4-0ubuntu1.10+esm3	USN-5686-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	git +14	2.39.1-1.el9	RHSA-2023:2319
RHEL 8	git +14	2.39.1-1.el8	RHSA-2023:2859

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.6 EUS	git +14	2.31.8-1.el8_6	RHSA-2024:0407

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	git +14	2.39.1-1.el9	ALSA-2023:2319
AlmaLinux 8	git +14	2.39.1-1.el8	ALSA-2023:2859

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	git	2.35.3-150300.10.18.1	SUSE-SU-2022:3931-1
SLES 15 SP3	git	2.35.3-150300.10.18.1	SUSE-SU-2022:3931-1
SLES 15 SP2	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES 15 SP1	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES 12 SP5	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1

Show 8 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP2	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES for SAP 15 SP1	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLES for SAP 12 SP5	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1
SLE HPC 15 SP2	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SLE HPC 15 SP1	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1
SUSE OpenStack Cloud 8	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1
SUSE HPE Helion OpenStack 8	git	2.26.2-27.60.1	SUSE-SU-2022:4271-1
SUSE Enterprise Storage 7	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	git	2.38.1-1.1	openSUSE-SU-2024:12487-1
openSUSE Leap 15.4	git	2.26.2-150000.47.1	SUSE-SU-2023:0418-1, SUSE-SU-2022:3931-1
openSUSE Leap 15.3	git	2.35.3-150300.10.18.1	SUSE-SU-2022:3931-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	git	2.38.1-r0	—
Alpine v3.23	git	2.38.1-r0	—
Alpine v3.22	git	2.38.1-r0	—
Alpine v3.21	git	2.38.1-r0	—
Alpine v3.20	git	2.38.1-r0	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	git	2.38.1-r0	—
Alpine v3.18	git	2.38.1-r0	—
Alpine v3.17	git	2.38.1-r0	—
Alpine v3.16	git	2.36.3-r0	—
Alpine v3.15	git	2.34.5-r0	—
Alpine v3.14	git	2.32.4-r0	—
Alpine v3.13	git	2.30.6-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	git +16	2.39.1-1.amzn2023.0.2	ALAS2023-2023-065
Amazon Linux 2	git +16	2.38.1-1.amzn2.0.1	ALAS2-2022-1886

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	git +14	2.39.1-1.el9	ELSA-2023-2319
Oracle Linux 8	git +14	2.39.1-1.el8	ELSA-2023-2859

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	git	2.38.1-r0	—

Advisories 22

ALSA-2023:2319 Moderate: git security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:2859 Moderate: git security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:0407 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:2859 Red Hat Security Advisory: git security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:2319 Red Hat Security Advisory: git security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-5686-2 git vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
WID-SEC-2022-1790 git: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 11, 2026
DSA-5332-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3239-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
USN-5686-1 git vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
SUSE-SU-2022:3931-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:0418-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12487-1 git-2.38.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
VDE-2023-001 PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jun 5, 2025
SUSE-SU-2022:4271-1 Security update for git SUSE / openSUSE Security Updates · May 2, 2025
ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
ELSA-2023-2859 Moderate: git security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 23, 2023
WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
ELSA-2023-2319 Moderate: git security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
ALAS2023-2023-065 Important: git security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
ALAS2-2022-1886 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 6, 2022

References

https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6
FEDORA-2022-8b58806840 vendor-advisory
https://support.apple.com/kb/HT213496
FEDORA-2022-53aadd995f vendor-advisory
20221107 APPLE-SA-2022-11-01-1 Xcode 14.1 mailing-list
FEDORA-2022-fb088df94c vendor-advisory
[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update mailing-list
GLSA-202312-15 vendor-advisory

CNA	v3.1	8.5
EUVD	v3.1	8.5