7.8
CVSSv3

CVE-2022-24765

Published: 12/04/2022 Updated: 27/12/2023
CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 616
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

git-scm git

fedoraproject fedora 34

fedoraproject fedora 35

fedoraproject fedora 36

fedoraproject fedora 37

apple xcode

debian debian linux 10.0

Vendor Advisories

Debian Bug report logs - #1014848 git: CVE-2022-29187 Package: src:git; Maintainer for src:git is Jonathan Nieder <jrnieder@gmailcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 13 Jul 2022 07:06:04 UTC Severity: important Tags: security, upstream Found in version git/1:2361-1 Reply or ...
Git could be made to run arbitrary commands as an administrator if it received specially crafted inputs ...
Synopsis Moderate: git security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for git is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having ...
Synopsis Moderate: git security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for git is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having ...
A vulnerability was found in Git This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository (CVE-2022-24765) ...
A vulnerability was found in Git This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository (CVE-2022-24765) ...
Severity Unknown Remote Unknown Type Unknown Description AVG-2679 git 2352-1 2353-1 Unknown Testing ...
A vulnerability was found in Git This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository (CVE-2022-24765) ...
ALAS-2022-236 Amazon Linux 2022 Security Advisory: ALAS-2022-236 Advisory Release Date: 2022-12-06 16:43 Pacific ...

Github Repositories

Ygor was written to factor common code amongst a handful of disparate projects.

Introduction This supporting library was written by hal clark over the span of many years (2010-2022) to house bits of code that are convenient for multiple projects Most, but not all of Ygor's routines are focused on scientific or mathematic applications (ie, geometry, simulation, optimization, and statistics) The routines in this library were all developed for specif

2ch browser for linux

JDim - 2ch browser for linux ここに書かれていない詳細は オンラインマニュアル を、 開発に参加するための手順については CONTRIBUTING や RFC を参照してください。 概要 動作プラットフォーム 導入方法 事前準備 ビルド Snapパッケージ 通常の起動 コマンドライン オプション 多重起動

BISDN Linux build system This repository holds the main repo manifest for setting up the build system for BISDN Linux, based on Yocto The build process takes around 3-4 hours with 8 CPU cores and 8 GiB RAM A single build requires ~70 GiB of disk space Adding additional CPU cores speeds up the build time significantly General requirements Disk space and RAM We recommend a

act-fail-example act fails when the git command is used in the workflow job: $ act push -W github/workflows/gityaml -j git-fail [Git command/git-fail] 🚀 Start image=ghcrio/catthehacker/ubuntu:act-latest [Git command/git-fail] 🐳 docker pull image=ghcrio/catthehacker/ubuntu:act-latest platform= username= forcePull=true [Git command/git-fail] 🐳 docker create i

Learning Git

Table of Contents Table of Contents Introduction Getting started The Three Trees Git checkout Change HTTPS to SSH Branches Branching example Renaming a branch Default git init branch HEAD Remotes Useful commands Show history of a file Undoing things Git reset Git clean Git revert Submodules GitHub GitHub Actions Encrypted secrets Safe directory Useful links

Recent Articles

Git for Windows issues update to fix running-someone-else’s-code vuln
The Register • Richard Speed • 01 Jan 1970

Get our weekly newsletter Running a multi-user Windows environment and Git? Time to patch

After a hefty Patch Tuesday comes news of an update for Git to deal with a vulnerability for the source shack when run on Microsoft's Windows. A variety of releases were emitted by the team. These include the latest maintenance release, 2.35.2, along with updates for older maintenance tracks (v2.30.3, v2.31.2, v2.32.1, v2.33.2, and v2.34.2.) The update is solely concerned with CVE-2022-24765, an interesting bug which afflicts the Git for Windows fork of Git. The vulnerability affects multi-user ...

References

CWE-427https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bashhttps://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScodehttp://www.openwall.com/lists/oss-security/2022/04/12/7https://support.apple.com/kb/HT213261http://seclists.org/fulldisclosure/2022/May/31https://lists.debian.org/debian-lts-announce/2022/12/msg00025.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/https://security.gentoo.org/glsa/202312-15https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014848https://ubuntu.com/security/notices/USN-5511-1https://nvd.nist.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-24-046-11https://alas.aws.amazon.com/AL2/ALAS-2022-1810.html