CVE-2023-23946: Git's `git apply` overwriting paths outside the working tree
A user can feed a specially crafted input to git apply to overwrite a path outside the working tree.
Other sources
A vulnerability was found in Git. This security issue occurs when feeding a crafted input to "git apply." A path outside the working tree can be overwritten by the user running "git apply."
By feeding a crafted input to "git apply", a path outside the working tree can be overwritten as the user who is running "git apply".
— Red Hat
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the working tree can be overwritten as the user who is running git apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
GitHub: CVE-2023-23946 mingit Remote Code Execution Vulnerability
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-23946?
CVE-2023-23946 is a vulnerability in the Git revision control system that allows remote code execution via path traversal.
Which software versions are affected by CVE-2023-23946?
CVE-2023-23946 affects versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 of Git.
What is the severity of CVE-2023-23946?
CVE-2023-23946 has a severity score of 7, which is considered high.
How can I fix CVE-2023-23946 in Visual Studio 2022 version 17.2?
To fix CVE-2023-23946 in Visual Studio 2022 version 17.2, you can either update to a version that includes the patch, or apply the patch manually by downloading it from the provided URL.
Where can I find more information about CVE-2023-23946?
You can find more information about CVE-2023-23946 on the Microsoft Security Response Center website, as well as the Bugzilla and Red Hat access pages linked in the references.