CVE-2022-41903 is a critical integer overflow vulnerability affecting Git, specifically within the git log and git archive functionalities. This flaw, rated 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allows for arbitrary heap writes, potentially leading to remote code execution. While there is no confirmed active exploitation, the vulnerability has garnered significant community attention with over 18 mentions and 5 media articles. Patches were released on January 17, 2023, and users are advised to upgrade or disable git archive in untrusted repositories.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.30.6CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.31.0, <= 2.31.5CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.32.0, <= 2.32.4CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.33.0, <= 2.33.5CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.34.0, <= 2.34.5CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.