Read the docs
TI-2022-20244 Aliases CVE-2022-41903

Integer overflow in `git archive`, `git log --format` leading to RCE in git

Priority HIGH 78CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 18 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.44268 98th percentileScored 2026-11-07
Fix Partial git (git): 2.30.7, 2.31.6, 2.32.5 +6Red Hat: 10 advisoriesRed Hat: 18 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gitgitbefore 2.30.7; 2.31.0 to before 2.31.6; 2.32.0 to before 2.32.5; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.6; 2.35.0 to before 2.35.6; 2.36.0 to before 2.36.4; 2.37.0 to before 2.37.5; 2.38.0 to before 2.38.3; = 2.39.02.30.7, 2.31.6, 2.32.5, 2.33.6, 2.34.6, 2.35.6, 2.36.4, 2.37.5, 2.38.3Patch availableCNA
  • git VendorGit Affected before 2.30.7; 2.31.0 to before 2.31.6; 2.32.0 to before 2.32.5; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.6; 2.35.0 to before 2.35.6; 2.36.0 to before 2.36.4; 2.37.0 to before 2.37.5; 2.38.0 to before 2.38.3; = 2.39.0 Fixed in 2.30.7, 2.31.6, 2.32.5, 2.33.6, 2.34.6, 2.35.6, 2.36.4, 2.37.5, 2.38.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*up to 2.30.6; 2.31.0 – 2.31.5; 2.32.0 – 2.32.4; 2.33.0 – 2.33.5; 2.34.0 – 2.34.5; 2.35.0 – 2.35.5; 2.36.0 – 2.36.3; 2.37.0 – 2.37.4; 2.38.0 – 2.38.2VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*2.39.0VulnerableGit-scm
  • cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* Versions up to 2.30.6; 2.31.0 – 2.31.5; 2.32.0 – 2.32.4; 2.33.0 – 2.33.5; 2.34.0 – 2.34.5; 2.35.0 – 2.35.5; 2.36.0 – 2.36.3; 2.37.0 – 2.37.4; 2.38.0 – 2.38.2 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:* Versions 2.39.0 Vulnerable ·Git-scm

Remediation

  • Fix · CNA git (git) Fixed in 2.30.7, 2.31.6, 2.32.5, 2.33.6, 2.34.6, 2.35.6, 2.36.4, 2.37.5, 2.38.3

Red Hat 10 advisories

  • RHSA-2023:1677 Released 2023-04-10 · Red Hat rating Important
    Red Hat Virtualization Host 4.4.z SP 1 security update batch#5 (oVirt-4.5.3-5)
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.3-202304051438_8.6, redhat-virtualization-host-image-update-4.5.3-202304051438_8.6
  • RHSA-2023:0978 Released 2023-02-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux Client Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-1.8.3.1-24.el7_9 +15
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-1.8.3.1-24.el7_9 +15
    • Red Hat Enterprise Linux Server (v. 7) git-1.8.3.1-24.el7_9, perl-Git-1.8.3.1-24.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-all-1.8.3.1-24.el7_9 +13
    • Red Hat Enterprise Linux Workstation (v. 7) git-1.8.3.1-24.el7_9, perl-Git-1.8.3.1-24.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-git-1.8.3.1-24.el7_9, emacs-git-el-1.8.3.1-24.el7_9, git-all-1.8.3.1-24.el7_9 +13
  • RHSA-2023:0628 Released 2023-02-07 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) git-2.31.1-3.el8_6, git-all-2.31.1-3.el8_6, git-core-2.31.1-3.el8_6 +12
Show 7 more Red Hat advisories
  • RHSA-2023:0627 Released 2023-02-07 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) git-2.31.1-3.el9_0, git-all-2.31.1-3.el9_0, git-core-2.31.1-3.el9_0 +12
  • RHSA-2023:0610 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.31.1-3.el8_7, git-all-2.31.1-3.el8_7, git-core-2.31.1-3.el8_7 +12
  • RHSA-2023:0611 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-2.31.1-3.el9_1, git-all-2.31.1-3.el9_1, git-core-2.31.1-3.el9_1 +12
  • RHSA-2023:0609 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) git-2.18.4-3.el8_2, git-all-2.18.4-3.el8_2, git-core-2.18.4-3.el8_2 +11
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) git-2.18.4-3.el8_2, git-all-2.18.4-3.el8_2, git-core-2.18.4-3.el8_2 +11
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) git-2.18.4-3.el8_2, git-all-2.18.4-3.el8_2, git-core-2.18.4-3.el8_2 +11
  • RHSA-2023:0596 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) git-2.27.0-3.el8_4, git-all-2.27.0-3.el8_4, git-core-2.27.0-3.el8_4 +12
  • RHSA-2023:0599 Released 2023-02-06 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) git-2.18.4-2.el8_1, git-all-2.18.4-2.el8_1, git-core-2.18.4-2.el8_1 +11
  • RHSA-2023:0597 Released 2023-02-06 · Red Hat rating Important
    rh-git227-git security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-git227-git-2.27.0-4.el7, rh-git227-git-all-2.27.0-4.el7, rh-git227-git-core-2.27.0-4.el7 +14
    • Red Hat Software Collections for RHEL(v. 7) rh-git227-git-2.27.0-4.el7, rh-git227-git-all-2.27.0-4.el7, rh-git227-git-core-2.27.0-4.el7 +14

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0610
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0611
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:0609
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2023:0599
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:0609
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:0596
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:0628
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:0627
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:0609
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:0978
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2023:0978
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0597
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0597
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2023:1677
Not affected: 1 product
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41903

References

Patch 1

Advisory 3

Other 1

  • TI-2025-30709 Git allows arbitrary code execution through broken config quoting KEVCVSS 3.1HIGH 8.1
  • TI-2022-07580 gitattributes parsing integer overflow in git CVSS 3.1CRITICAL 9.8
  • TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
  • TI-2024-21101 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVSS 3.1CRITICAL 9.1
  • TI-2023-10933 "git apply --reject" partially-controlled arbitrary file write CVSS 3.1HIGH 7.5
  • TI-2024-21116 Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVSS 3.1HIGH 7.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences