CVE-2022-29187

published 2022-07-12

CVE-2022-29187: Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to…

Priority P3 43 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.

Affected

22 ranges

Vendor	Product	Version range	Fixed in
apple	xcode	< 14.1	14.1
apple	xcode	—	—
debian	debian_linux	—	—
debian	git	< git 1:2.37.2-1 (bookworm)	git 1:2.37.2-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
git-scm	git	>= 2.30.3 < 2.30.5	2.30.5
git-scm	git	>= 2.31.2 < 2.31.4	2.31.4
git-scm	git	>= 2.32.1 < 2.32.3	2.32.3
git-scm	git	>= 2.33.2 < 2.33.4	2.33.4
git-scm	git	>= 2.34.2 < 2.34.4	2.34.4
git-scm	git	>= 2.35.2 < 2.35.4	2.35.4
git-scm	git	>= 2.36.0 < 2.36.2	2.36.2
git-scm	git	>= 2.37.0 < 2.37.1	2.37.1
git	git	>= 0 < 1:2.30.2-1+deb11u1	1:2.30.2-1+deb11u1
git	git	>= 0 < 1:2.37.2-1	1:2.37.2-1
git	git	>= 0 < 1:2.37.2-1	1:2.37.2-1
git	git	>= 0 < 1:2.37.2-1	1:2.37.2-1
git	git	>= 0 < 1:2.17.1-1ubuntu0.12	1:2.17.1-1ubuntu0.12
git	git	>= 0 < 1:2.25.1-1ubuntu3.5	1:2.25.1-1ubuntu3.5
git	git	>= 0 < 1:2.34.1-1ubuntu1.4	1:2.34.1-1ubuntu1.4

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.9 MEDIUM AV:L/AC:M/Au:N/C:C/I:C/A:C

osv 7.8 HIGH

vendor_debian 6.0 MEDIUM

vendor_redhat 6.0 MEDIUM

vendor_ubuntu 6.0 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-283