CVE-2023-23946

NameCVE-2023-23946
DescriptionGit, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3338-1, DSA-5357-1, ELA-808-1
Debian Bugs1031310

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
git (PTS)jessie, jessie (lts)1:2.1.4-2.1+deb8u13fixed
stretch (security)1:2.11.0-3+deb9u7vulnerable
stretch (lts), stretch1:2.11.0-3+deb9u10fixed
buster1:2.20.1-2+deb10u3vulnerable
buster (security)1:2.20.1-2+deb10u8fixed
bullseye (security), bullseye1:2.30.2-1+deb11u2fixed
bookworm1:2.39.2-1.1fixed
sid, trixie1:2.43.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gitsourcejessie1:2.1.4-2.1+deb8u13ELA-808-1
gitsourcestretch1:2.11.0-3+deb9u10ELA-808-1
gitsourcebuster1:2.20.1-2+deb10u8DLA-3338-1
gitsourcebullseye1:2.30.2-1+deb11u2DSA-5357-1
gitsource(unstable)1:2.39.2-11031310

Notes

https://www.openwall.com/lists/oss-security/2023/02/14/5
https://github.com/git/git/commit/fade728df1221598f42d391cf377e9e84a32053f (v2.30.8)

Search for package or bug name: Reporting problems