Skip to content
OpenAdvisories
Low · 3.3 CVE-2023-25815 EUVD-2023-29707

Git looks for localized messages in the wrong place

Published Apr 25, 2023 · Updated Nov 2, 2026 · Assigned by GitHub_M

Vendor: git-for-windows Product: git Package: git Package: git Package: git Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.

This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.

Affected products

VendorProductAffectedFixed
git-for-windows git < 2.40.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 git 1:2.40.1-1 —
Debian 13 git 1:2.40.1-1 —
Debian 12 git 1:2.39.5-0+deb12u1 DSA-5769-1
Debian 11 git 1:2.30.2-1+deb11u3 DLA-3867-1
Debian 10 git 1:2.20.1-2+deb10u9 DLA-3844-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS git 1:2.34.1-1ubuntu1.9 USN-6050-1
Ubuntu 20.04 LTS git 1:2.25.1-1ubuntu3.11 USN-6050-1
Ubuntu 18.04 LTS git 1:2.17.1-1ubuntu0.18 USN-6050-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS git 1:2.17.1-1ubuntu0.18+esm1 USN-7023-1
Ubuntu Pro 16.04 LTS git 1:2.7.4-0ubuntu1.10+esm8 USN-7023-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 git +14 2.39.3-1.el9_2 RHSA-2023:3245
RHEL 8 git +14 2.39.3-1.el8_8 RHSA-2023:3246
RHEL 3 rh-git227-git +16 2.27.0-6.el7 RHSA-2023:3280
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.0 EUS git +14 2.31.1-5.el9_0 RHSA-2023:3248
RHEL 8.6 EUS git +14 2.31.1-4.el8_6 RHSA-2023:3247
RHEL 8.4 EUS git +14 2.27.0-4.el8_4 RHSA-2023:3243
RHEL 8.2 AUS git +13 2.18.4-4.el8_2 RHSA-2023:3382
RHEL 8.1 E4S git +13 2.18.4-3.el8_1 RHSA-2023:3192

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 git +14 2.39.3-1.el9_2 ALSA-2023:3245
AlmaLinux 8 git +14 2.39.3-1.el8_8 ALSA-2023:3246

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 git 2.39.3-1.el8_8 RLSA-2023:3246

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-1
SLES 15 SP3 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-2
SLES 15 SP2 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1
SLES 15 SP1 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1
SLES 12 SP5 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP4 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SLES 12 SP2 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SLES for SAP 15 SP3 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-2
SLES for SAP 15 SP2 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1
SLES for SAP 15 SP1 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1
SLES for SAP 12 SP5 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SLES for SAP 12 SP4 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SLE Real Time 15 SP3 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-1
SLE HPC 15 SP3 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-2
SLE HPC 15 SP2 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1
SLE HPC 15 SP1 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1
SUSE OpenStack Cloud Crowbar 9 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SUSE OpenStack Cloud 9 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SUSE OpenStack Cloud 8 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SUSE Manager Server 4.2 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-2
SUSE Manager Proxy 4.2 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-2
SUSE HPE Helion OpenStack 8 git 2.26.2-27.69.1 SUSE-SU-2023:2062-1
SUSE Enterprise Storage 7.1 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-2
SUSE Enterprise Storage 7 git 2.26.2-150000.50.1 SUSE-SU-2023:2081-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed git 2.40.1-1.1 openSUSE-SU-2024:12889-1
openSUSE Leap 15.4 git 2.35.3-150300.10.27.1 SUSE-SU-2023:2038-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 git 2.40.1-r0 —
Alpine v3.23 git 2.40.1-r0 —
Alpine v3.22 git 2.40.1-r0 —
Alpine v3.21 git 2.40.1-r0 —
Alpine v3.20 git 2.40.1-r0 —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 git 2.40.1-r0 —
Alpine v3.18 git 2.40.1-r0 —
Alpine v3.17 git 2.38.5-r0 —
Alpine v3.16 git 2.36.6-r0 —
Alpine v3.15 git 2.34.8-r0 —
Alpine v3.14 git 2.32.7-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 git +14 2.39.3-1.el9_2 ELSA-2023-3245
Oracle Linux 8 git +14 2.39.3-1.el8_8 ELSA-2023-3246

Advisories 27

References