{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2022-41903", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-09-30T16:38:28.931Z", "datePublished": "2023-01-17T22:17:16.123Z", "dateUpdated": "2025-03-10T21:21:50.039Z" }, "containers": { "cna": { "title": "Integer overflow in `git archive`, `git log --format` leading to RCE in git", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } } ], "references": [ { "name": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq" }, { "name": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76" }, { "name": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst", "tags": [ "x_refsource_MISC" ], "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst" }, { "name": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem", "tags": [ "x_refsource_MISC" ], "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem" }, { "url": "https://security.gentoo.org/glsa/202312-15" } ], "affected": [ { "vendor": "git", "product": "git", "versions": [ { "version": "< 2.30.7", "status": "affected" }, { "version": ">= 2.31.0, < 2.31.6", "status": "affected" }, { "version": ">= 2.32.0, < 2.32.5", "status": "affected" }, { "version": ">= 2.33.0, < 2.33.6", "status": "affected" }, { "version": ">= 2.34.0, < 2.34.6", "status": "affected" }, { "version": ">= 2.35.0, < 2.35.6", "status": "affected" }, { "version": ">= 2.36.0, < 2.36.4", "status": "affected" }, { "version": ">= 2.37.0, < 2.37.5", "status": "affected" }, { "version": ">= 2.38.0, < 2.38.3", "status": "affected" }, { "version": "= 2.39.0", "status": "affected" } ] } ], "providerMetadata": { "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-27T10:06:32.604Z" }, "descriptions": [ { "lang": "en", "value": "Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`." } ], "source": { "advisory": "GHSA-475x-2q3q-hvwq", "discovery": "UNKNOWN" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:56:38.383Z" }, "title": "CVE Program Container", "references": [ { "name": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq" }, { "name": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76" }, { "name": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst" }, { "name": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem" }, { "url": "https://security.gentoo.org/glsa/202312-15", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-03-10T20:59:12.527761Z", "id": "CVE-2022-41903", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:21:50.039Z" } } ] } }