Skip to content
Fencer Vulns
high 8.8

CVE-2023-4759 json

Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

published 2023-09-12 3 y ago modified 2026-09-10 1 mo ago also GHSA-3p86-9955-h393 , EUVD-2023-2406

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0

In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.

This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.

The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.

Setting git configuration option core.symlinks = false before checking out avoids the problem.

The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.

The JGit maintainers would like to thank RyotaK for finding and reporting this issue.

Patch / fix

  • maven org.eclipse.jgit:org.eclipse.jgit 5.13.3.202401111512-r, 6.6.1.202309021850-r
  • Eclipse Foundation Eclipse JGit 5.13.3.202401111512-r
  • jgit Debian 14, Debian 13 6.7.0-1

debian advisories DEBIAN-CVE-2023-4759

  • eap8-log4j jboss enterprise application platform 8.0 2.19.0-2.redhat_00001.1.el9eap
  • eap8-parsson jboss enterprise application platform 8.0 1.1.5-1.redhat_00001.1.el9eap
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.1-3.GA_redhat_00002.1.el9eap
  • eap8-apache-sshd jboss enterprise application platform 8.0 2.12.0-1.redhat_00001.1.el9eap
  • eap8-lucene-core jboss enterprise application platform 8.0 8.11.2-2.redhat_00001.1.el9eap
  • eap8-lucene-join jboss enterprise application platform 8.0 8.11.2-2.redhat_00001.1.el9eap
  • eap8-lucene-solr jboss enterprise application platform 8.0 8.11.2-2.redhat_00001.1.el9eap
  • eap8-eclipse-jgit jboss enterprise application platform 8.0 6.6.1.202309021850-1.r_redhat_00001.1.el9eap

red hat advisories RHSA-2024:1193RHSA-2024:1192RHSA-2024:0710RHSA-2024:0711RHSA-2024:0712

  • jsch SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +10 more 0.2.9-150200.11.10.1
  • jgit openSUSE Leap 15.4 5.11.0-150200.3.15.2
  • eclipse-jgit openSUSE Leap 15.5, openSUSE Leap 15.4 5.11.0-150200.3.15.2

suse advisories SUSE-SU-2024:0057-1

  • jgit openSUSE Tumbleweed 5.11.0-2.1
  • eclipse-jgit openSUSE Tumbleweed 5.11.0-9.1

opensuse advisories openSUSE-SU-2025:15232-1openSUSE-SU-2024:13312-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4759 updated

jgit: arbitrary file overwrite

  • Red Hat JBoss Enterprise Application Platform Expansion Pack jgit jgit
    affected: no fix available
  • Red Hat EAP 8.0.1
    fixed: vendor fix RHSA-2024:1194
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-eclipse-jgit 5.13.2-1.SP1_redhat_00001.1.el7eap, eap7-insights-java-client 1.1.1-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2024:0710
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-eclipse-jgit 5.13.2-1.SP1_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2024:0711
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-eclipse-jgit 5.13.2-1.SP1_redhat_00001.1.el9eap, eap7-insights-java-client 1.1.1-1.redhat_00001.1.el9eap, eap7-wildfly-elytron 1.15.21-1.Final_redhat_00001.1.el9eap, eap7-wildfly-elytron-tool 1.15.21-1.Final_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2024:0712
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-log4j 2.19.0-2.redhat_00001.1.el8eap, eap8-parsson 1.1.5-1.redhat_00001.1.el8eap, eap8-wildfly 8.0.1-3.GA_redhat_00002.1.el8eap, eap8-apache-sshd 2.12.0-1.redhat_00001.1.el8eap, eap8-lucene-core 8.11.2-2.redhat_00001.1.el8eap, eap8-lucene-join 8.11.2-2.redhat_00001.1.el8eap, +9 more
    fixed: vendor fix RHSA-2024:1192
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-log4j 2.19.0-2.redhat_00001.1.el9eap, eap8-parsson 1.1.5-1.redhat_00001.1.el9eap, eap8-wildfly 8.0.1-3.GA_redhat_00002.1.el9eap, eap8-apache-sshd 2.12.0-1.redhat_00001.1.el9eap, eap8-lucene-core 8.11.2-2.redhat_00001.1.el9eap, eap8-lucene-join 8.11.2-2.redhat_00001.1.el9eap, +9 more
    fixed: vendor fix RHSA-2024:1193
  • Red Hat JBoss Enterprise Application Platform org.eclipse.jgit 5.13.2.SP1-redhat-00001
    fixed: vendor fix RHSA-2024:0714
show 1 more
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.15-2.GA_redhat_00002.1.el7eap, eap7-xml-security 2.2.6-1.redhat_00002.1.el7eap, eap7-resteasy 3.15.9-1.Final_redhat_00001.1.el7eap, eap7-hibernate 5.3.33-2.Final_redhat_00001.1.el7eap, eap7-jboss-msc 1.4.13-1.Final_redhat_00001.1.el7eap, eap7-jboss-cert-helper 1.1.1-1.redhat_00001.1.el7eap, +46 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.15-2.GA_redhat_00002.1.el8eap, eap7-xml-security 2.2.6-1.redhat_00002.1.el8eap, eap7-resteasy 3.15.9-1.Final_redhat_00001.1.el8eap, eap7-hibernate 5.3.33-2.Final_redhat_00001.1.el8eap, eap7-jboss-msc 1.4.13-1.Final_redhat_00001.1.el8eap, eap7-jboss-cert-helper 1.1.1-1.redhat_00001.1.el8eap, +48 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.15-2.GA_redhat_00002.1.el9eap, eap7-xml-security 2.2.6-1.redhat_00002.1.el9eap, eap7-resteasy 3.15.9-1.Final_redhat_00001.1.el9eap, eap7-hibernate 5.3.33-2.Final_redhat_00001.1.el9eap, eap7-jboss-msc 1.4.13-1.Final_redhat_00001.1.el9eap, eap7-jboss-cert-helper 1.1.1-1.redhat_00001.1.el9eap, +43 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1590 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jgit:org.eclipse.jgit
>=6.0.0.202111291000-r, <6.6.1.202309021850-r
<5.13.3.202401111512-r
6.6.1.202309021850-r
5.13.3.202401111512-r

Affected products

  • Eclipse Foundation Eclipse JGit
  • eclipse jgit

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-178 Improper Handling of Case Sensitivity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.