CVE-2023-25652 is a path traversal vulnerability in Git versions prior to 2.40.1, affecting products like Fedora and Git SCM. Specially crafted input to 'git apply --reject' can overwrite files outside the working tree with partially controlled content. With a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network without user interaction, leading to high integrity impacts. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion and media coverage. Organizations should update Git to a patched version or avoid using 'git apply --reject' with untrusted patches as a workaround.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.30.9CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.31.0, < 2.31.8CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.32.0, < 2.32.7CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.33.0, < 2.33.8CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.34.0, < 2.34.8CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write
Jun 13, 2023git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents
Apr 25, 2023