Read the docs
TI-2022-07580 Aliases CVE-2022-23521

gitattributes parsing integer overflow in git

Priority HIGH 82CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 18 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.56334 99th percentileScored 2026-11-07
Fix Partial git (git): 2.30.7, 2.31.6, 2.32.5 +6Red Hat: 10 advisoriesRed Hat: 18 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gitgitbefore 2.30.7; 2.31.0 to before 2.31.6; 2.32.0 to before 2.32.5; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.6; 2.35.0 to before 2.35.6; 2.36.0 to before 2.36.4; 2.37.0 to before 2.37.5; 2.38.0 to before 2.38.3; = 2.39.02.30.7, 2.31.6, 2.32.5, 2.33.6, 2.34.6, 2.35.6, 2.36.4, 2.37.5, 2.38.3Patch availableCNA
  • git VendorGit Affected before 2.30.7; 2.31.0 to before 2.31.6; 2.32.0 to before 2.32.5; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.6; 2.35.0 to before 2.35.6; 2.36.0 to before 2.36.4; 2.37.0 to before 2.37.5; 2.38.0 to before 2.38.3; = 2.39.0 Fixed in 2.30.7, 2.31.6, 2.32.5, 2.33.6, 2.34.6, 2.35.6, 2.36.4, 2.37.5, 2.38.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*up to 2.30.6; 2.31.0 – 2.31.5; 2.32.0 – 2.32.4; 2.33.0 – 2.33.5; 2.34.0 – 2.34.5; 2.35.0 – 2.35.5; 2.36.0 – 2.36.3; 2.37.0 – 2.37.4; 2.38.0 – 2.38.2VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*2.39.0VulnerableGit-scm
  • cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* Versions up to 2.30.6; 2.31.0 – 2.31.5; 2.32.0 – 2.32.4; 2.33.0 – 2.33.5; 2.34.0 – 2.34.5; 2.35.0 – 2.35.5; 2.36.0 – 2.36.3; 2.37.0 – 2.37.4; 2.38.0 – 2.38.2 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:* Versions 2.39.0 Vulnerable ·Git-scm

Remediation

  • Fix · CNA git (git) Fixed in 2.30.7, 2.31.6, 2.32.5, 2.33.6, 2.34.6, 2.35.6, 2.36.4, 2.37.5, 2.38.3

Red Hat 10 advisories

  • RHSA-2023:1677 Released 2023-04-10 · Red Hat rating Important
    Red Hat Virtualization Host 4.4.z SP 1 security update batch#5 (oVirt-4.5.3-5)
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.3-202304051438_8.6, redhat-virtualization-host-image-update-4.5.3-202304051438_8.6
  • RHSA-2023:0978 Released 2023-02-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux Client Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-1.8.3.1-24.el7_9 +15
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-1.8.3.1-24.el7_9 +15
    • Red Hat Enterprise Linux Server (v. 7) git-1.8.3.1-24.el7_9, perl-Git-1.8.3.1-24.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-all-1.8.3.1-24.el7_9 +13
    • Red Hat Enterprise Linux Workstation (v. 7) git-1.8.3.1-24.el7_9, perl-Git-1.8.3.1-24.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-all-1.8.3.1-24.el7_9 +13
  • RHSA-2023:0628 Released 2023-02-07 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) git-2.31.1-3.el8_6, git-all-2.31.1-3.el8_6, git-core-2.31.1-3.el8_6 +12
Show 7 more Red Hat advisories
  • RHSA-2023:0627 Released 2023-02-07 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) git-2.31.1-3.el9_0, git-all-2.31.1-3.el9_0, git-core-2.31.1-3.el9_0 +12
  • RHSA-2023:0610 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.31.1-3.el8_7, git-all-2.31.1-3.el8_7, git-core-2.31.1-3.el8_7 +12
  • RHSA-2023:0611 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-2.31.1-3.el9_1, git-all-2.31.1-3.el9_1, git-core-2.31.1-3.el9_1 +12
  • RHSA-2023:0609 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) git-2.18.4-3.el8_2, git-all-2.18.4-3.el8_2, git-core-2.18.4-3.el8_2 +11
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) git-2.18.4-3.el8_2, git-all-2.18.4-3.el8_2, git-core-2.18.4-3.el8_2 +11
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) git-2.18.4-3.el8_2, git-all-2.18.4-3.el8_2, git-core-2.18.4-3.el8_2 +11
  • RHSA-2023:0596 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) git-2.27.0-3.el8_4, git-all-2.27.0-3.el8_4, git-core-2.27.0-3.el8_4 +12
  • RHSA-2023:0599 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) git-2.18.4-2.el8_1, git-all-2.18.4-2.el8_1, git-core-2.18.4-2.el8_1 +11
  • RHSA-2023:0597 Released 2023-02-06 · Red Hat rating Important
    rh-git227-git security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-git227-git-2.27.0-4.el7, rh-git227-git-all-2.27.0-4.el7, rh-git227-git-core-2.27.0-4.el7 +14
    • Red Hat Software Collections for RHEL(v. 7) rh-git227-git-2.27.0-4.el7, rh-git227-git-all-2.27.0-4.el7, rh-git227-git-core-2.27.0-4.el7 +14

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0610
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0611
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:0609
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2023:0599
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:0609
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:0596
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:0628
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:0627
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:0609
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0597
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0597
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2023:1677
Not affected: 1 product
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23521

References

Patch 1

Advisory 1

Other 1

  • TI-2025-30709 Git allows arbitrary code execution through broken config quoting KEVCVSS 3.1HIGH 8.1
  • TI-2022-20244 Integer overflow in `git archive`, `git log --format` leading to RCE in git CVSS 3.1CRITICAL 9.8
  • TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
  • TI-2024-21101 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVSS 3.1CRITICAL 9.1
  • TI-2023-10933 "git apply --reject" partially-controlled arbitrary file write CVSS 3.1HIGH 7.5
  • TI-2024-21116 Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVSS 3.1HIGH 7.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences