CVE-2023-23946

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-23946
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-23946.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-23946
Aliases
  • GHSA-r87m-v37r-cwfh
Downstream
Related
Published
2023-02-14T19:48:00.554Z
Modified
2026-02-04T22:58:46.359314Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Git's `git apply` overwriting paths outside the working tree
Details

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the working tree can be overwritten as the user who is running git apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23946.json"
}
References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type
GIT
Repo
https://github.com/git-for-windows/git
Events
Introduced
853373155dce195a91e6e41a58c8b8e5c5a94652
Fixed
2cfea1bdd7ee8ad1ca93f957c25d323a44dbd5c3
Fixed
a82fa99b36ddfd643e61ed45e52abe314687df67

Affected versions

v2.*
v2.35.0.windows.1
v2.35.1.windows.1
v2.35.1.windows.2
v2.35.2.windows.1
v2.36.0-rc0.windows.1
v2.36.0-rc1.windows.1
v2.36.0-rc2.windows.1
v2.36.0.windows.1
v2.36.1.windows.1
v2.37.0-rc0.windows.1
v2.37.0-rc1.windows.1
v2.37.0-rc2.windows.1
v2.37.0.windows.1
v2.37.1.windows.1
v2.37.2.windows.1
v2.37.2.windows.2
v2.37.3.windows.1
v2.38.0-rc0.windows.1
v2.38.0-rc1.windows.1
v2.38.0-rc2.windows.1
v2.38.0.windows.1
v2.38.1.windows.1
v2.39.0-rc0.windows.1
v2.39.0-rc1.windows.1
v2.39.0-rc2.windows.1
v2.39.0.windows.1
v2.39.0.windows.2
v2.39.1.windows.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-23946.json"

Git / github.com/git/git

Affected ranges

Type
GIT
Repo
https://github.com/git/git
Events
Introduced
a5828ae6b52137b913b978e16cd2334482eb4c1f
Fixed
0bbcf951943eefbbfee2a7e08b7150bef5b60562
Introduced
ebf3c04b262aa27fbb97f8a0156c2347fecafafb
Fixed
2aedeff35fde779b03b57125b1f50f6c528bfbea
Fixed
394a759d2b5f0a1a1908c820cf142f45cb78718c
Introduced
6cd33dceed60949e2dbc32e3f0f5e67c4c882e1e
Fixed
673472a9635805d3b1fcd0038ecc0a9418078685
Introduced
3dcec76d9df911ed8321007b1d197c1a206dc164
Fixed
7556e5d737b917d31ac3729b0f5e2391da7e132a
Introduced
cd3e606211bb1cf8bc57f7d76bab98cc17a150bc
Fixed
91da4a29e168ab465beb713fca4d389193f8f16c
Introduced
89bece5c8c96f0b962cfc89e63f82d603fd60bed
Fixed
b7a92d078b9b9a39553623815699eb029074e39d
Fixed
c867e4fa180bec4750e9b54eb10f459030dbebfd
Introduced
c48035d29b4e524aed3a32f0403676f0d9128863
Fixed
cbf04937d5b9fcf0a76c28f69e6294e9e3ecd7e6
Introduced
e4a4b31577c7419497ac30cebe30d755b97752c5
Fixed
eb88fe1ff5ceb34845f0919b8bdc60d8a1703cf6
Introduced
225bc32a989d7a22fa6addafd4ce7dcd04675dbf
Fixed
ed4404af3c936d87ac2c6ff12cc3da495511bec9

Affected versions

v2.*
v2.30.3
v2.30.4
v2.30.5
v2.30.6
v2.30.7
v2.30.8
v2.31.0
v2.31.1
v2.31.2
v2.31.3
v2.31.4
v2.31.5
v2.31.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-23946.json"