Strix
26.1K

CVE-2022-39260

HIGHCVSS 8.8/10EPSS 2.94%

Last modified

CVE-2022-39260 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. EPSS estimates a 2.94% chance of exploitation in the next 30 days.

Description

Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
2.94%

85.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Git-ScmGit< 2.30.6
Git-ScmGit>= 2.31.0, < 2.31.5
Git-ScmGit>= 2.32.0, < 2.32.4
Git-ScmGit>= 2.33.0, < 2.33.5
Git-ScmGit>= 2.34.0, < 2.34.5
Git-ScmGit>= 2.35.0, < 2.35.5
Git-ScmGit>= 2.36.0, < 2.36.3
Git-ScmGit>= 2.37.0, < 2.37.4
Git-ScmGit2.38.0
FedoraprojectFedora35
FedoraprojectFedora36
FedoraprojectFedora37
AppleXcode< 14.1
DebianDebian Linux10.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-39260?
Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.
How severe is CVE-2022-39260?
CVE-2022-39260 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 2.94% probability of exploitation in the next 30 days.
How do I fix CVE-2022-39260?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-39260?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST