Vulnerability · NVD

CVE-2022-39260

HIGH 8.5 Published on 2022-10-19

Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.

Attack vector : Network No user interaction

Show raw CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS 3.12% above median percentile 86.6%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Git Windows winget:Git.Git

Affected — Fixed in — Latest tracked 2.55.0.3 undetermined
Xcode macOS com.apple.dt.Xcode

Affected <14.1 Fixed in 14.1 Latest tracked 26.6 patched

Vulnerable CPE configurations (10)

Vendor	Product	Platform	Versions	CPE 2.3 URI
git-scm	git All platforms (wildcard)	All platforms (wildcard)	<2.30.6	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.31.0 <2.31.5	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.32.0 <2.32.4	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.33.0 <2.33.5	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.34.0 <2.34.5	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.35.0 <2.35.5	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.36.0 <2.36.3	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	≥2.37.0 <2.37.4	cpe:2.3:a:git-scm:git::::::::
git-scm	git All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:git-scm:git:2.38.0:::::::*
apple	xcode All platforms (wildcard)	All platforms (wildcard)	<14.1	cpe:2.3:a:apple:xcode::::::::

View on NVD ↗ Advisory · github.com