CVE-2023-22490 (Other, published 2023-02-14T20:15Z)
Description: value: Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.

A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/git/git
Files changed:
Documentation/RelNotes/2.30.8.txt
Commit message: Sync with Git 2.39.2


Vulnerable code:

Fixed code:
 Git v2.30.8 Release Notes
 =========================
 
 This release addresses the security issues CVE-2023-22490 and
 CVE-2023-23946.
 
 
 Fixes since v2.30.7
 -------------------
 
  * CVE-2023-22490:
 
    Using a specially-crafted repository, Git can be tricked into using
    its local clone optimization even when using a non-local transport.
    Though Git will abort local clones whose source $GIT_DIR/objects
    directory contains symbolic links (c.f., CVE-2022-39253), the objects
    directory itself may still be a symbolic link.
 
    These two may be combined to include arbitrary files based on known
    paths on the victim's filesystem within the malicious repository's
    working copy, allowing for data exfiltration in a similar manner as
    CVE-2022-39253.
 
  * CVE-2023-23946:
 
    By feeding a crafted input to "git apply", a path outside the
    working tree can be overwritten as the user who is running "git
    apply".
 
  * A mismatched type in `attr.c::read_attr_from_index()` which could
    cause Git to errantly reject attributes on Windows and 32-bit Linux
    has been corrected.
 
 Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was
 developed by Taylor Blau, with additional help from others on the
 Git security mailing list.
 
 Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the
 fix was developed by Patrick Steinhardt.
 
 
 Johannes Schindelin (1):
       attr: adjust a mismatched data type
 
 Patrick Steinhardt (1):
       apply: fix writing behind newly created symbolic links
 
 Taylor Blau (3):
       t5619: demonstrate clone_local() with ambiguous transport
       clone: delay picking a transport until after get_repo_path()
       dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS