CVE-2023-23946
- Source
- https://cve.org/CVERecord?id=CVE-2023-23946
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-23946.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-23946
- Aliases
-
- GHSA-r87m-v37r-cwfh
- Downstream
- Related
- Published
- 2023-02-14T19:48:00.554Z
- Modified
- 2026-02-11T14:42:11.983867Z
- Severity
-
- 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Git's `git apply` overwriting paths outside the working tree
- Details
-
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to
git apply, a path outside the working tree can be overwritten as the user who is runninggit apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, usegit apply --statto inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link. - Database specific
{ "cwe_ids": [ "CWE-22" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23946.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23946.json
- https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd
- https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh
- https://nvd.nist.gov/vuln/detail/CVE-2023-23946
- https://security.gentoo.org/glsa/202312-15
Affected packages
Git / github.com/git-for-windows/git
Affected ranges
- Type
- GIT
- Repo
- https://github.com/git-for-windows/git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixed
Affected versions
v2.*
v2.35.0.windows.1
v2.35.1.windows.1
v2.35.1.windows.2
v2.35.2.windows.1
v2.36.0-rc0.windows.1
v2.36.0-rc1.windows.1
v2.36.0-rc2.windows.1
v2.36.0.windows.1
v2.36.1.windows.1
v2.37.0-rc0.windows.1
v2.37.0-rc1.windows.1
v2.37.0-rc2.windows.1
v2.37.0.windows.1
v2.37.1.windows.1
v2.37.2.windows.1
v2.37.2.windows.2
v2.37.3.windows.1
v2.38.0-rc0.windows.1
v2.38.0-rc1.windows.1
v2.38.0-rc2.windows.1
v2.38.0.windows.1
v2.38.1.windows.1
v2.39.0-rc0.windows.1
v2.39.0-rc1.windows.1
v2.39.0-rc2.windows.1
v2.39.0.windows.1
v2.39.0.windows.2
v2.39.1.windows.1
Git / github.com/git/git
Affected ranges
- Type
- GIT
- Repo
- https://github.com/git/git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
Affected versions
v2.*
v2.30.3
v2.30.4
v2.30.5
v2.30.6
v2.30.7
v2.30.8
v2.31.2
v2.31.3
v2.31.4
v2.31.5
v2.31.6
v2.31.7
v2.32.1
v2.32.2
v2.32.3
v2.32.4
v2.32.5
v2.32.6
v2.33.0
v2.33.1
v2.33.2
v2.33.3
v2.33.4
v2.33.5
v2.33.6
v2.33.7
v2.34.0
v2.34.0-rc0
v2.34.0-rc1
v2.34.0-rc2
v2.34.1
v2.34.2
v2.34.3
v2.34.4
v2.34.5
v2.34.6
v2.34.7
v2.35.0
v2.35.0-rc0
v2.35.0-rc1
v2.35.0-rc2
v2.35.1
v2.35.2
v2.35.3
v2.35.4
v2.35.5
v2.35.6
v2.35.7
v2.36.0
v2.36.0-rc0
v2.36.0-rc1
v2.36.0-rc2
v2.36.1
v2.36.2
v2.36.3
v2.36.4
v2.36.5
v2.37.0
v2.37.0-rc0
v2.37.0-rc1
v2.37.0-rc2
v2.37.1
v2.37.2
v2.37.3
v2.37.4
v2.37.5
v2.37.6
v2.38.0
v2.38.0-rc0
v2.38.0-rc1
v2.38.0-rc2
v2.38.1
v2.38.2
v2.38.3
v2.38.4
v2.39.0
v2.39.0-rc0
v2.39.0-rc1
v2.39.0-rc2
v2.39.1
v2.39.2