GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-41903 (GCVE-0-2022-41903)

Vulnerability from cvelistv5 – Published: 2023-01-17 22:17 – Updated: 2025-03-10 21:21
VLAI
Title
Integer overflow in `git archive`, `git log --format` leading to RCE in git
Summary
Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 20:59 UTC
CWE
  • CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
Vendor Product Version CPE status
git git Affected: < 2.30.7
Affected: >= 2.31.0, < 2.31.6
Affected: >= 2.32.0, < 2.32.5
Affected: >= 2.33.0, < 2.33.6
Affected: >= 2.34.0, < 2.34.6
Affected: >= 2.35.0, < 2.35.6
Affected: >= 2.36.0, < 2.36.4
Affected: >= 2.37.0, < 2.37.5
Affected: >= 2.38.0, < 2.38.3
Affected: = 2.39.0
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
          },
          {
            "name": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
          },
          {
            "name": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
          },
          {
            "name": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41903",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T20:59:12.527761Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T21:21:50.039Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.30.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.31.0, \u003c 2.31.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.32.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.33.0, \u003c 2.33.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.34.0, \u003c 2.34.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.35.0, \u003c 2.35.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.36.0, \u003c 2.36.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.37.0, \u003c 2.37.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.38.0, \u003c 2.38.3"
            },
            {
              "status": "affected",
              "version": "= 2.39.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-27T10:06:32.604Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
        },
        {
          "name": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
        },
        {
          "name": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
        },
        {
          "name": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
        },
        {
          "url": "https://security.gentoo.org/glsa/202312-15"
        }
      ],
      "source": {
        "advisory": "GHSA-475x-2q3q-hvwq",
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow in `git archive`, `git log --format` leading to RCE in git"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41903",
    "datePublished": "2023-01-17T22:17:16.123Z",
    "dateReserved": "2022-09-30T16:38:28.931Z",
    "dateUpdated": "2025-03-10T21:21:50.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-41903",
      "date": "2026-09-19",
      "epss": "0.44268",
      "percentile": "0.98699"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8D0B133C-FC2B-4CBF-8840-C85F6D650510",
                  "versionEndIncluding": "2.30.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BA5113C4-D095-4E76-A6C6-F849E11DFA9D",
                  "versionEndIncluding": "2.31.5",
                  "versionStartIncluding": "2.31.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B82E8E87-1083-45B9-A273-E6AB31548D56",
                  "versionEndIncluding": "2.32.4",
                  "versionStartIncluding": "2.32.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C9162726-CACE-4CB9-ACDE-204655D6BB3B",
                  "versionEndIncluding": "2.33.5",
                  "versionStartIncluding": "2.33.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "65D149AF-5604-4109-A60B-CB7B5BBBEE87",
                  "versionEndIncluding": "2.34.5",
                  "versionStartIncluding": "2.34.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "383C057B-98D3-4AC6-9D43-AE13CC81FEC4",
                  "versionEndIncluding": "2.35.5",
                  "versionStartIncluding": "2.35.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7B191BB2-D3C9-440D-8F7F-237BE0CBDB96",
                  "versionEndIncluding": "2.36.3",
                  "versionStartIncluding": "2.36.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E3F7AE8C-A383-442C-8E74-7BC13E8B251D",
                  "versionEndIncluding": "2.37.4",
                  "versionStartIncluding": "2.37.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "28F8851A-1566-4F16-AEC4-2C09AC866C2A",
                  "versionEndIncluding": "2.38.2",
                  "versionStartIncluding": "2.38.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CC98AC76-7F3E-45A0-9DE6-3D097CEE5199",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."
        },
        {
          "lang": "es",
          "value": "Git es un sistema de control de revisiones distribuido. `git log` puede mostrar confirmaciones en un formato arbitrario usando sus especificadores `--format`. Esta funcionalidad tambi\u00e9n est\u00e1 expuesta a \"git archive\" a trav\u00e9s del atributo git \"export-subst\". Al procesar los operadores de relleno, hay un desbordamiento de enteros en `pretty.c::format_and_pad_commit()` donde `size_t` se almacena incorrectamente como `int` y luego se agrega como un desplazamiento a `memcpy()`. Este desbordamiento puede ser desencadenado directamente por un usuario que ejecuta un comando que invoca la maquinaria de formato de commit (por ejemplo, `git log --format=...`). Tambi\u00e9n se puede activar indirectamente a trav\u00e9s del archivo git mediante el mecanismo export-subst, que expande los especificadores de formato dentro de los archivos dentro del repositorio durante un archivo git. Este desbordamiento de enteros puede dar lugar a escrituras arbitrarias en el almacenamiento din\u00e1mico, lo que puede dar lugar a la ejecuci\u00f3n de c\u00f3digo arbitrario. El problema ha sido solucionado en las versiones publicadas el 17-01-2023, remont\u00e1ndose a la v2.30.7. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben desactivar \"git archive\" en repositorios que no sean de confianza. Si expone el archivo git a trav\u00e9s de `git daemon`, desact\u00edvelo ejecutando `git config --global daemon.uploadArch false`."
        }
      ],
      "id": "CVE-2022-41903",
      "lastModified": "2024-11-21T07:24:01.993",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-01-17T23:15:15.690",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://security.gentoo.org/glsa/202312-15"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://security.gentoo.org/glsa/202312-15"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-190"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2023-01-23T00:00:00.000Z",
      "cve": "CVE-2022-41903",
      "id": "msrc_CVE-2022-41903",
      "initial_release_date": "2023-01-04T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Integer overflow in `git archive` `git log --format` leading to RCE in git",
      "url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2022-41903.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "git",
                "vendor": "git",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.30.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.31.0, \u003c 2.31.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.32.0, \u003c 2.32.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.33.0, \u003c 2.33.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.34.0, \u003c 2.34.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.35.0, \u003c 2.35.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.36.0, \u003c 2.36.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.37.0, \u003c 2.37.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.38.0, \u003c 2.38.3"
                  },
                  {
                    "status": "affected",
                    "version": "= 2.39.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D0B133C-FC2B-4CBF-8840-C85F6D650510",
                    "versionEndIncluding": "2.30.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BA5113C4-D095-4E76-A6C6-F849E11DFA9D",
                    "versionEndIncluding": "2.31.5",
                    "versionStartIncluding": "2.31.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B82E8E87-1083-45B9-A273-E6AB31548D56",
                    "versionEndIncluding": "2.32.4",
                    "versionStartIncluding": "2.32.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C9162726-CACE-4CB9-ACDE-204655D6BB3B",
                    "versionEndIncluding": "2.33.5",
                    "versionStartIncluding": "2.33.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "65D149AF-5604-4109-A60B-CB7B5BBBEE87",
                    "versionEndIncluding": "2.34.5",
                    "versionStartIncluding": "2.34.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "383C057B-98D3-4AC6-9D43-AE13CC81FEC4",
                    "versionEndIncluding": "2.35.5",
                    "versionStartIncluding": "2.35.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7B191BB2-D3C9-440D-8F7F-237BE0CBDB96",
                    "versionEndIncluding": "2.36.3",
                    "versionStartIncluding": "2.36.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E3F7AE8C-A383-442C-8E74-7BC13E8B251D",
                    "versionEndIncluding": "2.37.4",
                    "versionStartIncluding": "2.37.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28F8851A-1566-4F16-AEC4-2C09AC866C2A",
                    "versionEndIncluding": "2.38.2",
                    "versionStartIncluding": "2.38.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC98AC76-7F3E-45A0-9DE6-3D097CEE5199",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."
          },
          {
            "lang": "es",
            "value": "Git es un sistema de control de revisiones distribuido. `git log` puede mostrar confirmaciones en un formato arbitrario usando sus especificadores `--format`. Esta funcionalidad tambi\u00e9n est\u00e1 expuesta a \"git archive\" a trav\u00e9s del atributo git \"export-subst\". Al procesar los operadores de relleno, hay un desbordamiento de enteros en `pretty.c::format_and_pad_commit()` donde `size_t` se almacena incorrectamente como `int` y luego se agrega como un desplazamiento a `memcpy()`. Este desbordamiento puede ser desencadenado directamente por un usuario que ejecuta un comando que invoca la maquinaria de formato de commit (por ejemplo, `git log --format=...`). Tambi\u00e9n se puede activar indirectamente a trav\u00e9s del archivo git mediante el mecanismo export-subst, que expande los especificadores de formato dentro de los archivos dentro del repositorio durante un archivo git. Este desbordamiento de enteros puede dar lugar a escrituras arbitrarias en el almacenamiento din\u00e1mico, lo que puede dar lugar a la ejecuci\u00f3n de c\u00f3digo arbitrario. El problema ha sido solucionado en las versiones publicadas el 17-01-2023, remont\u00e1ndose a la v2.30.7. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben desactivar \"git archive\" en repositorios que no sean de confianza. Si expone el archivo git a trav\u00e9s de `git daemon`, desact\u00edvelo ejecutando `git config --global daemon.uploadArch false`."
          }
        ],
        "id": "CVE-2022-41903",
        "lastModified": "2026-06-17T05:04:01.900",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-41903",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T20:59:12.527761Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-01-17T23:15:15.690",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://security.gentoo.org/glsa/202312-15"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.gentoo.org/glsa/202312-15"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-10T15:18:11+00:00",
      "cve": "CVE-2022-41903",
      "id": "CVE-2022-41903",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "509",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "git: Heap overflow in `git archive`, `git log --format` leading to RCE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41903.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T02:34:09Z",
      "cve": "CVE-2022-41903",
      "id": "CVE-2022-41903",
      "initial_release_date": "2023-02-15T03:23:18Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "141",
      "product_status:recommended": "714",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-41903",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-41903.json",
      "version": "30"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T12:56:38.383Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
              },
              {
                "name": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
              },
              {
                "name": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
              },
              {
                "name": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://security.gentoo.org/glsa/202312-15"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-41903",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-10T20:59:12.527761Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-10T20:59:13.878Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "git",
              "vendor": "git",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.30.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.31.0, \u003c 2.31.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.32.0, \u003c 2.32.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.33.0, \u003c 2.33.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.34.0, \u003c 2.34.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.35.0, \u003c 2.35.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.36.0, \u003c 2.36.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.37.0, \u003c 2.37.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.38.0, \u003c 2.38.3"
                },
                {
                  "status": "affected",
                  "version": "= 2.39.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-190",
                  "description": "CWE-190: Integer Overflow or Wraparound",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-12-27T10:06:32.604Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq"
            },
            {
              "name": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76"
            },
            {
              "name": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst"
            },
            {
              "name": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem"
            },
            {
              "url": "https://security.gentoo.org/glsa/202312-15"
            }
          ],
          "source": {
            "advisory": "GHSA-475x-2q3q-hvwq",
            "discovery": "UNKNOWN"
          },
          "title": "Integer overflow in `git archive`, `git log --format` leading to RCE in git"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2022-41903",
        "datePublished": "2023-01-17T22:17:16.123Z",
        "dateReserved": "2022-09-30T16:38:28.931Z",
        "dateUpdated": "2025-03-10T21:21:50.039Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.