CVE-2022-24975

CWE-668 — Exposure to Wrong SphereCWE-200 — Information Exposure6 documents6 sources
Severity
7.5HIGH
EPSS
0.7%
top 28.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Git-scm GIT
Timeline
PublishedFeb 11
Latest updateFeb 12

Description

The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDgit-scm/git2.35.1

🔴Vulnerability Details

3
GHSA
GHSA-wx8f-p63x-543f: The --mirror documentation for Git through 2↗2022-02-12
▶
CVEList
CVE-2022-24975: The --mirror documentation for Git through 2↗2022-02-11
▶
OSV
CVE-2022-24975: The --mirror documentation for Git through 2↗2022-02-11
▶

📋Vendor Advisories

2
Red Hat
git: The --mirror option for git leaks secret for deleted content, aka the "GitBleed"↗2022-02-11
▶
Debian
CVE-2022-24975: git - The --mirror documentation for Git through 2.35.1 does not mention the availabil...↗2022
▶
CVE-2022-24975 (HIGH CVSS 7.5) | The --mirror documentation for Git | cvebase.io