CVE-2022-41903 — Integer overflow in `git archive`, `git log --format` leading to RCE in git

Description

Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.

Affected products

Vendor	Product	Affected	Fixed
git	git	< 2.30.7, >= 2.31.0, < 2.31.6, >= 2.32.0, < 2.32.5, >= 2.33.0, < 2.33.6, >= 2.34.0, < 2.34.6, >= 2.35.0, < 2.35.6, >= 2.36.0, < 2.36.4, >= 2.37.0, < 2.37.5, >= 2.38.0, < 2.38.3, = 2.39.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	git	1:2.39.1-0.1	—
Debian 13	git	1:2.39.1-0.1	—
Debian 12	git	1:2.39.1-0.1	—
Debian 11	git	1:2.30.2-1+deb11u1	DSA-5332-1
Debian 10	git	1:2.20.1-2+deb10u7	DLA-3282-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	git	1:2.34.1-1ubuntu1.6	USN-5810-1
Ubuntu 20.04 LTS	git	1:2.25.1-1ubuntu3.8	USN-5810-1
Ubuntu 18.04 LTS	git	1:2.17.1-1ubuntu0.15	USN-5810-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	git	1:2.7.4-0ubuntu1.10+esm4	USN-5810-3
Ubuntu Pro 14.04 LTS	git	1:1.9.1-1ubuntu0.10+esm1	USN-5810-4

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	git +14	2.31.1-3.el9_1	RHSA-2023:0611
RHEL 8	git +14	2.31.1-3.el8_7	RHSA-2023:0610
RHEL 7	git +17	1.8.3.1-24.el7_9	RHSA-2023:0978
RHEL 3	rh-git227-git +16	2.27.0-4.el7	RHSA-2023:0597

Show 8 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhev Hypervisor 4	redhat-virtualization-host +1	4.5.3-202304051438_8.6	RHSA-2023:1677
RHEL 9.0 EUS	git +14	2.31.1-3.el9_0	RHSA-2023:0627
RHEL 8.6 EUS	git +14	2.31.1-3.el8_6	RHSA-2023:0628
RHEL 8.4 EUS	git +14	2.27.0-3.el8_4	RHSA-2023:0596
RHEL 8.2 TUS	git +13	2.18.4-3.el8_2	RHSA-2023:0609
RHEL 8.2 E4S	git +13	2.18.4-3.el8_2	RHSA-2023:0609
RHEL 8.2 AUS	git +13	2.18.4-3.el8_2	RHSA-2023:0609
RHEL 8.1 E4S	git +13	2.18.4-2.el8_1	RHSA-2023:0599

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	git +14	2.31.1-3.el9_1	ALSA-2023:0611
AlmaLinux 8	git +14	2.31.1-3.el8_7	ALSA-2023:0610

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	git	2.31.1-3.el9_1	RLSA-2023:0611
Rocky Linux 8	git	2.31.1-3.el8_7	RLSA-2023:0610

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SLES 15 SP3	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SLES 15 SP2	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SLES 15 SP1	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SLES 12 SP5	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1

Show 21 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP4	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SLES 12 SP2	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SLES for SAP 15 SP3	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SLES for SAP 15 SP2	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SLES for SAP 15 SP1	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SLES for SAP 12 SP5	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SLES for SAP 12 SP4	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SLE Real Time 15 SP3	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SLE HPC 15 SP3	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SLE HPC 15 SP2	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SLE HPC 15 SP1	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SUSE OpenStack Cloud Crowbar 9	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SUSE OpenStack Cloud 9	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SUSE OpenStack Cloud 8	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SUSE Manager Server 4.2	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SUSE Manager Retail Branch Server 4.2	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SUSE Manager Proxy 4.2	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SUSE HPE Helion OpenStack 8	git	2.26.2-27.63.2	SUSE-SU-2023:0109-1
SUSE Enterprise Storage 7.1	git	2.35.3-150300.10.21.1	SUSE-SU-2023:0110-1
SUSE Enterprise Storage 7	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1
SUSE Enterprise Storage 6	git	2.26.2-150000.44.1	SUSE-SU-2023:0108-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	git	2.39.1-1.1	openSUSE-SU-2024:12625-1
openSUSE Leap 15.4	git	2.26.2-150000.44.1	SUSE-SU-2023:0110-1, SUSE-SU-2023:0108-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	git	2.39.1-r0	—
Alpine v3.23	git	2.39.1-r0	—
Alpine v3.22	git	2.39.1-r0	—
Alpine v3.21	git	2.39.1-r0	—
Alpine v3.20	git	2.39.1-r0	—

Show 6 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	git	2.39.1-r0	—
Alpine v3.18	git	2.39.1-r0	—
Alpine v3.17	git	2.38.3-r0	—
Alpine v3.16	git	2.36.4-r0	—
Alpine v3.15	git	2.34.6-r0	—
Alpine v3.14	git	2.32.5-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	git +16	2.39.1-1.amzn2023.0.2	ALAS2023-2023-065
Amazon Linux 2	git +16	2.39.1-1.amzn2.0.1	ALAS2-2023-1923

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 2 (CBL-Mariner)	git	2.33.8-2	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	git +14	2.31.1-3.el9_1	ELSA-2023-0611
Oracle Linux 8	git +14	2.31.1-3.el8_7	ELSA-2023-0610
Oracle Linux 7	git +17	1.8.3.1-24.el7_9	ELSA-2023-0978

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	git	2.39.1-r0	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

sondermc/git-cveissues ★ 0 · Jan 26, 2023

vulnerabilities, CVE-2022-41903, and CVE-2022-23521, that affect versions 2.39 and older. Git for Windows was also patched to address an additional, Windows-specific issue known as CVE-2022-41953.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 37

WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
ALSA-2023:0611 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:0610 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
RHSA-2023:1677 Red Hat Security Advisory: Red Hat Virtualization Host 4.4.z SP 1 security update batch#5 (oVirt-4.5.3-5) Red Hat Security Advisories (RHSA) · Aug 7, 2026
RHSA-2023:0978 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0627 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0628 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0610 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0611 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0609 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0599 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0596 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2023:0597 Red Hat Security Advisory: rh-git227-git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2026-1608 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 19, 2026
USN-5810-4 git vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
USN-5810-3 git vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
DSA-5332-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3282-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
USN-5810-1 git vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
RLSA-2023:0610 Important: git security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2023:0611 Important: git security update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2023:0110-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:0108-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12625-1 git-2.39.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
SUSE-SU-2023:0109-1 Security update for git SUSE / openSUSE Security Updates · May 2, 2025
2NGA002579 ABB Arctic communication solution ARM600 Vulnerabilities ABB PSIRT · Apr 7, 2025
ICSA-25-105-08 ABB M2M Gateway CISA ICS & IT advisories · Apr 7, 2025
ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
WID-SEC-2023-0105 GitLab und Git: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jan 22, 2024
ELSA-2023-0978 Important: git security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 28, 2023
ALAS2023-2023-065 Important: git security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
ELSA-2023-0611 Important: git security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 7, 2023
ELSA-2023-0610 Important: git security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 7, 2023
ALAS2-2023-1923 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 4, 2023

CNA	v3.1	9.8
EUVD	v3.1	9.8

Integer overflow in `git archive`, `git log --format` leading to RCE in git

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Public exploits

GitHub 1 repository

Advisories 37

References