Homepage
About Snyk

Directory Traversal Affecting git package, versions *

low

Snyk CVSS

    Attack Complexity Low
    Integrity High

    Threat Intelligence

    EPSS 0.08% (34th percentile)
Expand this section
NVD
7.5 high
Expand this section
SUSE
7.8 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-GIT-5461949
  • published 26 Apr 2023
  • disclosed 25 Apr 2023
Report a new vulnerability Found a mistake?

Introduced: 25 Apr 2023

CVE-2023-25652 Open this link in a new tab
CWE-22 Open this link in a new tab

How to fix?

There is no fixed version for Debian:11 git.

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using git apply with --reject when applying patches from an untrusted source. Use git apply --stat to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the *.rej file exists.

References