Skip to content
Fencer Vulns
critical 9.8

CVE-2022-23521 in the critical feed json

gitattributes parsing integer overflow in git

published 2023-01-17 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-28555

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
56.3%
EPSS 56.3% chance of exploitation in 30 days, percentile 99%
public exploits
0
none known

Summary

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.

Patch / fix

  • git Debian 14, Debian 13, Debian 12 1:2.39.1-0.1

debian advisories DEBIAN-CVE-2022-23521

  • git Ubuntu 18.04 LTS 1:2.17.1-1ubuntu0.15
  • git Ubuntu 20.04 LTS 1:2.25.1-1ubuntu3.8
  • git Ubuntu 22.04 LTS 1:2.34.1-1ubuntu1.6
  • git Ubuntu Pro 14.04 LTS 1:1.9.1-1ubuntu0.10+esm1
  • git Ubuntu Pro 16.04 LTS 1:2.7.4-0ubuntu1.10+esm4

ubuntu advisories UBUNTU-CVE-2022-23521

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.5.3-202304051438_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.3-202304051438_8.6
  • git RHEL 7 1.8.3.1-24.el7_9
  • gitk RHEL 7 1.8.3.1-24.el7_9
  • git-hg RHEL 7 1.8.3.1-24.el7_9
  • git-p4 RHEL 7 1.8.3.1-24.el7_9
  • gitweb RHEL 7 1.8.3.1-24.el7_9
  • git-all RHEL 7 1.8.3.1-24.el7_9

red hat advisories RHSA-2023:1677RHSA-2023:0978RHSA-2023:0628RHSA-2023:0596RHSA-2023:0627RHSA-2023:0597

  • git SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +9 more 2.35.3-150300.10.21.1
  • git SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +7 more 2.26.2-27.63.2
  • git SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +6 more 2.26.2-150000.44.1

suse advisories SUSE-SU-2023:0110-1SUSE-SU-2023:0109-1SUSE-SU-2023:0108-1

  • git openSUSE Tumbleweed 2.39.1-1.1

opensuse advisories openSUSE-SU-2024:12625-1

  • git AlmaLinux 8 2.31.1-3.el8_7
  • gitk AlmaLinux 8 2.31.1-3.el8_7
  • gitweb AlmaLinux 8 2.31.1-3.el8_7
  • git-all AlmaLinux 8 2.31.1-3.el8_7
  • git-gui AlmaLinux 8 2.31.1-3.el8_7
  • git-svn AlmaLinux 8 2.31.1-3.el8_7
  • git-core AlmaLinux 8 2.31.1-3.el8_7
  • perl-Git AlmaLinux 8 2.31.1-3.el8_7

almalinux advisories ALSA-2023:0610ALSA-2023:0611

  • git Rocky Linux 9 2.31.1-3.el9_1
  • git Rocky Linux 8 2.31.1-3.el8_7

rocky linux advisories RLSA-2023:0611RLSA-2023:0610

  • git Alpine 3.14 2.32.5-r0
  • git Alpine 3.15 2.34.6-r0
  • git Alpine 3.16 2.36.4-r0
  • git Alpine 3.17 2.38.3-r0
  • git Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 2.39.1-r0

alpine advisories ALPINE-CVE-2022-23521

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • git CBL-Mariner 2.0 2.33.8-2

azure linux advisories AZL-13024

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23521 updated cvss 9.8

git: gitattributes parsing integer overflow

  • Red Hat Enterprise Linux 6 git, gitk, gitweb, git-all, git-cvs, git-gui, +6 more
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Data Grid 7 git
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) git 2.31.1-3.el8_7, gitk 2.31.1-3.el8_7, gitweb 2.31.1-3.el8_7, git-all 2.31.1-3.el8_7, git-gui 2.31.1-3.el8_7, git-svn 2.31.1-3.el8_7, +8 more
    fixed: vendor fix RHSA-2023:0610
  • Red Hat Enterprise Linux AppStream (v. 9) git 2.31.1-3.el9_1, gitk 2.31.1-3.el9_1, gitweb 2.31.1-3.el9_1, git-all 2.31.1-3.el9_1, git-gui 2.31.1-3.el9_1, git-svn 2.31.1-3.el9_1, +8 more
    fixed: vendor fix RHSA-2023:0611
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) git 2.18.4-3.el8_2, gitk 2.18.4-3.el8_2, gitweb 2.18.4-3.el8_2, git-all 2.18.4-3.el8_2, git-gui 2.18.4-3.el8_2, git-svn 2.18.4-3.el8_2, +7 more
    fixed: vendor fix RHSA-2023:0609
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) git 2.18.4-2.el8_1, gitk 2.18.4-2.el8_1, gitweb 2.18.4-2.el8_1, git-all 2.18.4-2.el8_1, git-gui 2.18.4-2.el8_1, git-svn 2.18.4-2.el8_1, +7 more
    fixed: vendor fix RHSA-2023:0599
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) git 2.18.4-3.el8_2, gitk 2.18.4-3.el8_2, gitweb 2.18.4-3.el8_2, git-all 2.18.4-3.el8_2, git-gui 2.18.4-3.el8_2, git-svn 2.18.4-3.el8_2, +7 more
    fixed: vendor fix RHSA-2023:0609
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) git 2.27.0-3.el8_4, gitk 2.27.0-3.el8_4, gitweb 2.27.0-3.el8_4, git-all 2.27.0-3.el8_4, git-gui 2.27.0-3.el8_4, git-svn 2.27.0-3.el8_4, +8 more
    fixed: vendor fix RHSA-2023:0596
show 7 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) git 2.31.1-3.el8_6, gitk 2.31.1-3.el8_6, gitweb 2.31.1-3.el8_6, git-all 2.31.1-3.el8_6, git-gui 2.31.1-3.el8_6, git-svn 2.31.1-3.el8_6, +8 more
    fixed: vendor fix RHSA-2023:0628
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) git 2.31.1-3.el9_0, gitk 2.31.1-3.el9_0, gitweb 2.31.1-3.el9_0, git-all 2.31.1-3.el9_0, git-gui 2.31.1-3.el9_0, git-svn 2.31.1-3.el9_0, +8 more
    fixed: vendor fix RHSA-2023:0627
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) git 2.18.4-3.el8_2, gitk 2.18.4-3.el8_2, gitweb 2.18.4-3.el8_2, git-all 2.18.4-3.el8_2, git-gui 2.18.4-3.el8_2, git-svn 2.18.4-3.el8_2, +7 more
    fixed: vendor fix RHSA-2023:0609
  • Red Hat Enterprise Linux Client Optional (v. 7) git 1.8.3.1-24.el7_9, gitk 1.8.3.1-24.el7_9, git-hg 1.8.3.1-24.el7_9, git-p4 1.8.3.1-24.el7_9, gitweb 1.8.3.1-24.el7_9, git-all 1.8.3.1-24.el7_9, +12 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) git 1.8.3.1-24.el7_9, gitk 1.8.3.1-24.el7_9, git-hg 1.8.3.1-24.el7_9, git-p4 1.8.3.1-24.el7_9, gitweb 1.8.3.1-24.el7_9, git-all 1.8.3.1-24.el7_9, +12 more Red Hat Enterprise Linux Server (v. 7) git 1.8.3.1-24.el7_9, perl-Git 1.8.3.1-24.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) gitk 1.8.3.1-24.el7_9, git-hg 1.8.3.1-24.el7_9, git-p4 1.8.3.1-24.el7_9, gitweb 1.8.3.1-24.el7_9, git-all 1.8.3.1-24.el7_9, git-bzr 1.8.3.1-24.el7_9, +10 more Red Hat Enterprise Linux Workstation (v. 7) git 1.8.3.1-24.el7_9, perl-Git 1.8.3.1-24.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) gitk 1.8.3.1-24.el7_9, git-hg 1.8.3.1-24.el7_9, git-p4 1.8.3.1-24.el7_9, gitweb 1.8.3.1-24.el7_9, git-all 1.8.3.1-24.el7_9, git-bzr 1.8.3.1-24.el7_9, +10 more
    fixed: vendor fix RHSA-2023:0978
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-git227-git 2.27.0-4.el7, rh-git227-gitk 2.27.0-4.el7, rh-git227-git-p4 2.27.0-4.el7, rh-git227-gitweb 2.27.0-4.el7, rh-git227-git-all 2.27.0-4.el7, rh-git227-git-cvs 2.27.0-4.el7, +10 more Red Hat Software Collections for RHEL(v. 7) rh-git227-git 2.27.0-4.el7, rh-git227-gitk 2.27.0-4.el7, rh-git227-git-p4 2.27.0-4.el7, rh-git227-gitweb 2.27.0-4.el7, rh-git227-git-all 2.27.0-4.el7, rh-git227-git-cvs 2.27.0-4.el7, +10 more
    fixed: vendor fix RHSA-2023:0597
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.5.3-202304051438_8.6, redhat-virtualization-host-image-update 4.5.3-202304051438_8.6
    fixed: vendor fix RHSA-2023:1677
  • Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.5.3-6.el8ev, redhat-release-virtualization-host-content 4.5.3-6.el8ev, redhat-virtualization-host-image-update-placeholder 4.5.3-6.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-105-08 updated cvss 8.8

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-046-11 updated cvss 9.8

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

56.33% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • git git

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.