CVE-2023-29007

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that are longer than 1024 characters can used to exploit a bug in config.c::git_config_copy_or_rename_section_in_file(). This bug can be used to inject arbitrary configuration into a users $GIT_DIR/config when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as core.pager, core.editor, core.sshCommand, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running git submodule deinit on untrusted repositories or without prior inspection of any submodule sections in $GIT_DIR/config.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name	Vendor	Start Version	End Version
Git	Git-scm	*	2.30.9 (excluding)
Git	Git-scm	2.31.0 (including)	2.31.8 (excluding)
Git	Git-scm	2.32.0 (including)	2.32.7 (excluding)
Git	Git-scm	2.33.0 (including)	2.33.8 (excluding)
Git	Git-scm	2.34.0 (including)	2.34.8 (excluding)
Git	Git-scm	2.35.0 (including)	2.35.8 (excluding)
Git	Git-scm	2.36.0 (including)	2.36.5 (excluding)
Git	Git-scm	2.37.0 (including)	2.37.7 (excluding)
Git	Git-scm	2.38.0 (including)	2.38.5 (excluding)
Git	Git-scm	2.39.0 (including)	2.39.3 (excluding)
Git	Git-scm	2.40.0 (including)	2.40.0 (including)
Red Hat Enterprise Linux 7	RedHat	git-0:1.8.3.1-25.el7_9	*
Red Hat Enterprise Linux 8	RedHat	git-0:2.39.3-1.el8_8	*
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	RedHat	git-0:2.18.4-3.el8_1	*
Red Hat Enterprise Linux 8.2 Advanced Update Support	RedHat	git-0:2.18.4-4.el8_2	*
Red Hat Enterprise Linux 8.4 Extended Update Support	RedHat	git-0:2.27.0-4.el8_4	*
Red Hat Enterprise Linux 8.6 Extended Update Support	RedHat	git-0:2.31.1-4.el8_6	*
Red Hat Enterprise Linux 9	RedHat	git-0:2.39.3-1.el9_2	*
Red Hat Enterprise Linux 9.0 Extended Update Support	RedHat	git-0:2.31.1-5.el9_0	*
Red Hat Software Collections for Red Hat Enterprise Linux 7	RedHat	rh-git227-git-0:2.27.0-6.el7	*
Git	Ubuntu	bionic	*
Git	Ubuntu	devel	*
Git	Ubuntu	esm-infra/bionic	*
Git	Ubuntu	esm-infra/focal	*
Git	Ubuntu	esm-infra/xenial	*
Git	Ubuntu	focal	*
Git	Ubuntu	jammy	*
Git	Ubuntu	kinetic	*
Git	Ubuntu	lunar	*
Git	Ubuntu	trusty	*
Git	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-29007
CWE	https://cwe.mitre.org/data/definitions/74.html

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Weakness

Affected Software

Potential Mitigations

References

CVE-2023-29007

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References