CVE-2023-25652: "git apply --reject" partially-controlled arbitrary file write
A vulnerability was found in Git. This security flaw occurs when feeding specially crafted input to git apply --reject; a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch.
Other sources
CVE-2023-25652 By feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch).
— Red Hat
Git could allow a remote attacker to bypass security restrictions. By feeding specially crafted input to git apply --reject, an attacker could exploit this vulnerability to overwrite a path outside the working tree.
— IBM
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using git apply with --reject when applying patches from an untrusted source. Use git apply --stat to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the .rej file exists.
GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-25652?
CVE-2023-25652 refers to a vulnerability in Git that allows an attacker to overwrite a file outside of the working tree with partially controlled contents.
How severe is CVE-2023-25652?
CVE-2023-25652 has a severity rating of high.
Which versions of Git are affected by CVE-2023-25652?
The vulnerability affects Git versions prior to 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1.
How can I fix CVE-2023-25652?
To fix CVE-2023-25652, you should update Git to version 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, or 2.40.1.
Where can I find more information about CVE-2023-25652?
You can find more information about CVE-2023-25652 at the following references: [Reference 1](https://access.redhat.com/security/cve/CVE-2023-25652), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2189765), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2189766).