CVE-2022-23521
CriticalGit is distributed revision control system.
Published Feb 21, 2023 · Updated Aug 12, 2026 · Also known as ALPINE-CVE-2022-23521, DEBIAN-CVE-2022-23521, DLA-3282-1, DSA-5332-1, GHSA-c738-c5qq-xg89, SUSE-SU-2023:0108-1, SUSE-SU-2023:0109-1, SUSE-SU-2023:0110-1, UBUNTU-CVE-2022-23521, USN-5810-1, USN-5810-3, USN-5810-4
Key Facts
Patch immediately- CVE-2022-23521 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Git (Git-Scm), rootio-git, emacs-git (amazon) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 56% probability of exploitation in the next 30 days.
- Fixed versions are available, including emacs-git 1.8.3.1-24.el7_9, emacs-git 2.38.3-1.78.amzn1, emacs-git-el 1.8.3.1-24.el7_9.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
56%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-23521 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted .gitattributes file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Products
479 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GitGit-Scm | 2.39.0, >= < 2.30.7 | 2.30.6 |
| rootio-gitrootio | See advisory | 1:2.30.2-1+deb11u1 |
| emacs-gitamazon | See advisory | 2.38.3-1.78.amzn1 |
| emacs-git-elamazon | See advisory | 2.38.3-1.78.amzn1 |
| git-allamazon | See advisory | 2.38.3-1.78.amzn1 |
Patched Releases
emacs-git
1.8.3.1-24.el7_9, 2.38.3-1.78.amzn1
emacs-git-el
1.8.3.1-24.el7_9, 2.38.3-1.78.amzn1
Git
0:1.8.3.1-24.el7_9, 0:2.18.4-3.el8_2, 0:2.31.1-3.el9_1, 1:1.9.1-1ubuntu0.10+esm1, 1:2.17.1-1ubuntu0.14, 1:2.17.1-1ubuntu0.15, 1:2.20.1-2+deb10u7, 1:2.25.1-1ubuntu3.7, 1:2.25.1-1ubuntu3.8, 1:2.30.2-1+deb11u1, 1:2.34.1-1ubuntu1.6, 1:2.39.1-0.1, 1:2.7.4-0ubuntu1.10+esm4, 1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.32.5-r0, 2.33.6-1, 2.33.8-2, 2.34.6-r0, 2.35.3-150300.10.21.1, 2.35.6-1.ph3, 2.35.6-1.ph4, 2.36.4-r0, 2.38.3-1.78.amzn1, 2.38.3-r0, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2, 2.39.1-r0, 2.43.7-1.ph5, <=2.30.6
git-all
1.8.3.1-24.el7_9, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.38.3-1.78.amzn1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-arch
2.26.2-150000.44.1, 2.26.2-27.63.2, 2.35.3-150300.10.21.1, 2.39.1-1.1
git-bzr
1.8.3.1-24.el7_9, 2.38.3-1.78.amzn1
git-core
2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.38.3-1.78.amzn1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-core-doc
2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.38.3-1.78.amzn1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-credential-gnome-keyring
2.35.3-150300.10.21.1, 2.39.1-1.1
git-credential-libsecret
2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-cvs
1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.35.3-150300.10.21.1, 2.38.3-1.78.amzn1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-daemon
1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.38.3-1.78.amzn1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-doc
2.26.2-150000.44.1, 2.26.2-27.63.2, 2.35.3-150300.10.21.1, 2.39.1-1.1
git-email
1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.38.3-1.78.amzn1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-extras
2.35.6-1.ph4, 2.43.7-1.ph5
git-gnome-keyring
1.8.3.1-24.el7_9
git-gui
1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-hg
1.8.3.1-24.el7_9, 2.38.3-1.78.amzn1
git-instaweb
1.8.3.1-24.el7_9, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.38.3-1.78.amzn1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-lang
2.35.6-1.ph4, 2.43.7-1.ph5
git-p4
1.8.3.1-24.el7_9, 2.35.3-150300.10.21.1, 2.38.3-1.78.amzn1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-subtree
2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.38.3-1.78.amzn1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-svn
1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.38.3-1.78.amzn1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
git-web
2.26.2-150000.44.1, 2.26.2-27.63.2, 2.35.3-150300.10.21.1, 2.39.1-1.1
gitk
1.8.3.1-24.el7_9, 2.26.2-150000.44.1, 2.26.2-27.63.2, 2.31.1-3.el8_7, 2.31.1-3.el9_1, 2.35.3-150300.10.21.1, 2.39.1-1.1, 2.39.1-1.amzn2.0.1, 2.39.1-1.amzn2023.0.2
Timeline
Publicly disclosed
Feb 21, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-190 Integer Overflow or Wraparound
References
- advisoryhttps://access.redhat.com/documentation/en-us/microshift/4.12/html/release_notes/index
- advisoryhttps://access.redhat.com/documentation/en-us/red_hat_build_of_microshift/4.12/html/release_notes/index
- advisoryRHSA-2023:0596
- advisoryRHSA-2023:0597
- advisoryRHSA-2023:0599
FAQ
Common Questions.
Git is distributed revision control system.
Affected: Git (Git-Scm) versions 2.39.0, >= < 2.30.7; rootio-git; emacs-git (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including emacs-git 1.8.3.1-24.el7_9, emacs-git 2.38.3-1.78.amzn1, emacs-git-el 1.8.3.1-24.el7_9.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-23521 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo