cve-2022-39260
Vulnerability from cvelistv5
Published
2022-10-19 00:00
Modified
2024-08-03 12:00
Severity ?
8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.
References
security-advisories@github.comhttp://seclists.org/fulldisclosure/2022/Nov/1Mailing List, Third Party Advisory
security-advisories@github.comhttps://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6Mitigation, Third Party Advisory
security-advisories@github.comhttps://lists.debian.org/debian-lts-announce/2022/12/msg00025.htmlMailing List, Third Party Advisory
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/
security-advisories@github.comhttps://security.gentoo.org/glsa/202312-15
security-advisories@github.comhttps://support.apple.com/kb/HT213496Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Nov/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/12/msg00025.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202312-15
af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213496Third Party Advisory
Impacted products
Vendor Product Version
git git Version: < 2.30.6
Version: > 2.31.0, < 2.31.5
Version: > 2.32.0, < 2.32.4
Version: > 2.33.0, < 2.33.5
Version: > 2.34.0, < 2.34.5
Version: > 2.34.0, < 2.35.5
Version: > 2.35.0, < 2.36.3
Version: > 2.37.0, < 2.37.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:00:43.573Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6",
               },
               {
                  name: "FEDORA-2022-8b58806840",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT213496",
               },
               {
                  name: "FEDORA-2022-53aadd995f",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/",
               },
               {
                  name: "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2022/Nov/1",
               },
               {
                  name: "FEDORA-2022-fb088df94c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/",
               },
               {
                  name: "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html",
               },
               {
                  name: "GLSA-202312-15",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-15",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "git",
               vendor: "git",
               versions: [
                  {
                     status: "affected",
                     version: "< 2.30.6",
                  },
                  {
                     status: "affected",
                     version: "> 2.31.0, < 2.31.5",
                  },
                  {
                     status: "affected",
                     version: "> 2.32.0, < 2.32.4",
                  },
                  {
                     status: "affected",
                     version: "> 2.33.0, < 2.33.5",
                  },
                  {
                     status: "affected",
                     version: "> 2.34.0, < 2.34.5",
                  },
                  {
                     status: "affected",
                     version: "> 2.34.0, < 2.35.5",
                  },
                  {
                     status: "affected",
                     version: "> 2.35.0, < 2.36.3",
                  },
                  {
                     status: "affected",
                     version: "> 2.37.0, < 2.37.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-122",
                     description: "CWE-122: Heap-based Buffer Overflow",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-27T10:06:16.422068",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6",
            },
            {
               name: "FEDORA-2022-8b58806840",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/",
            },
            {
               url: "https://support.apple.com/kb/HT213496",
            },
            {
               name: "FEDORA-2022-53aadd995f",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/",
            },
            {
               name: "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2022/Nov/1",
            },
            {
               name: "FEDORA-2022-fb088df94c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/",
            },
            {
               name: "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html",
            },
            {
               name: "GLSA-202312-15",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-15",
            },
         ],
         source: {
            advisory: "GHSA-rjr6-wcq6-83p6",
            discovery: "UNKNOWN",
         },
         title: "Git vulnerable to Remote Code Execution via Heap overflow in `git shell`",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-39260",
      datePublished: "2022-10-19T00:00:00",
      dateReserved: "2022-09-02T00:00:00",
      dateUpdated: "2024-08-03T12:00:43.573Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.30.6\", \"matchCriteriaId\": \"28199E8F-36D0-46F8-AF0A-9460390BE56F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.31.0\", \"versionEndExcluding\": \"2.31.5\", \"matchCriteriaId\": \"E095AAE7-18C2-4957-9740-FC804860B9C2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.32.0\", \"versionEndExcluding\": \"2.32.4\", \"matchCriteriaId\": \"459EE43E-40FB-45BE-A1CC-51435E9F92AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.33.0\", \"versionEndExcluding\": \"2.33.5\", \"matchCriteriaId\": \"2CBDDA42-F5EC-4747-BF3C-16683D684702\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.34.0\", \"versionEndExcluding\": \"2.34.5\", \"matchCriteriaId\": \"D7691E22-145E-4D97-A6E0-6515742781B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.35.0\", \"versionEndExcluding\": \"2.35.5\", \"matchCriteriaId\": \"E02396C2-BB34-4D18-917E-DA56EA7B58B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.36.0\", \"versionEndExcluding\": \"2.36.3\", \"matchCriteriaId\": \"51BEAEEC-9D9D-4CFE-8958-43BFE87DE501\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.37.0\", \"versionEndExcluding\": \"2.37.4\", \"matchCriteriaId\": \"566CF89C-AC39-47D7-B3DE-633B2237F816\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1AFEECCB-B8DB-4270-A860-C2BA1C7B267C\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\", \"matchCriteriaId\": \"CECD39AA-41F4-4638-B59A-C5E928B585C3\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.\"}, {\"lang\": \"es\", \"value\": \"Git es un sistema de control de revisiones distribuido, escalable y de c\\u00f3digo abierto. \\\"git shell\\\" es un shell de acceso restringido que puede ser usado para implementar la funcionalidad push/pull de Git por medio de SSH. En versiones anteriores a 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4, la funci\\u00f3n que divide los argumentos del comando en un array usa incorrectamente un \\\"int\\\" para representar el n\\u00famero de entradas en el array, permitiendo a un actor malicioso desbordar intencionadamente el valor de retorno, conllevando a escrituras arbitrarias en la pila. Dado que la matriz resultante es pasada a \\\"execv()\\\", es posible aprovechar este ataque para obtener la ejecuci\\u00f3n de c\\u00f3digo remota en una m\\u00e1quina v\\u00edctima. Tenga en cuenta que una v\\u00edctima debe permitir primero el acceso a \\\"git shell\\\" como shell de inicio de sesi\\u00f3n para ser vulnerable a este ataque. Este problema est\\u00e1 parcheado en versiones 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 y es recomendado a usuarios actualizar a la \\u00faltima versi\\u00f3n. Deshabilitar el acceso al \\\"git shell\\\" por medio de inicios de sesi\\u00f3n remotos es una mitigaci\\u00f3n viable a corto plazo\"}]",
         id: "CVE-2022-39260",
         lastModified: "2024-11-21T07:17:54.090",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 8.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
         published: "2022-10-19T12:15:10.160",
         references: "[{\"url\": \"http://seclists.org/fulldisclosure/2022/Nov/1\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://security.gentoo.org/glsa/202312-15\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://support.apple.com/kb/HT213496\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Nov/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202312-15\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://support.apple.com/kb/HT213496\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
         sourceIdentifier: "security-advisories@github.com",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-122\"}, {\"lang\": \"en\", \"value\": \"CWE-787\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2022-39260\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-10-19T12:15:10.160\",\"lastModified\":\"2024-11-21T07:17:54.090\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.\"},{\"lang\":\"es\",\"value\":\"Git es un sistema de control de revisiones distribuido, escalable y de código abierto. \\\"git shell\\\" es un shell de acceso restringido que puede ser usado para implementar la funcionalidad push/pull de Git por medio de SSH. En versiones anteriores a 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4, la función que divide los argumentos del comando en un array usa incorrectamente un \\\"int\\\" para representar el número de entradas en el array, permitiendo a un actor malicioso desbordar intencionadamente el valor de retorno, conllevando a escrituras arbitrarias en la pila. Dado que la matriz resultante es pasada a \\\"execv()\\\", es posible aprovechar este ataque para obtener la ejecución de código remota en una máquina víctima. Tenga en cuenta que una víctima debe permitir primero el acceso a \\\"git shell\\\" como shell de inicio de sesión para ser vulnerable a este ataque. Este problema está parcheado en versiones 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 y es recomendado a usuarios actualizar a la última versión. Deshabilitar el acceso al \\\"git shell\\\" por medio de inicios de sesión remotos es una mitigación viable a corto plazo\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.30.6\",\"matchCriteriaId\":\"28199E8F-36D0-46F8-AF0A-9460390BE56F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.31.0\",\"versionEndExcluding\":\"2.31.5\",\"matchCriteriaId\":\"E095AAE7-18C2-4957-9740-FC804860B9C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.32.0\",\"versionEndExcluding\":\"2.32.4\",\"matchCriteriaId\":\"459EE43E-40FB-45BE-A1CC-51435E9F92AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.33.0\",\"versionEndExcluding\":\"2.33.5\",\"matchCriteriaId\":\"2CBDDA42-F5EC-4747-BF3C-16683D684702\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.34.0\",\"versionEndExcluding\":\"2.34.5\",\"matchCriteriaId\":\"D7691E22-145E-4D97-A6E0-6515742781B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.35.0\",\"versionEndExcluding\":\"2.35.5\",\"matchCriteriaId\":\"E02396C2-BB34-4D18-917E-DA56EA7B58B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.36.0\",\"versionEndExcluding\":\"2.36.3\",\"matchCriteriaId\":\"51BEAEEC-9D9D-4CFE-8958-43BFE87DE501\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.37.0\",\"versionEndExcluding\":\"2.37.4\",\"matchCriteriaId\":\"566CF89C-AC39-47D7-B3DE-633B2237F816\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AFEECCB-B8DB-4270-A860-C2BA1C7B267C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\",\"matchCriteriaId\":\"CECD39AA-41F4-4638-B59A-C5E928B585C3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2022/Nov/1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://security.gentoo.org/glsa/202312-15\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://support.apple.com/kb/HT213496\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Nov/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202312-15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.apple.com/kb/HT213496\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.