Vulnerability-Lookup

ubuntu-cve-2023-29007

Vulnerability from osv_ubuntu

Published

2023-04-25 17:00

Modified

2025-09-08 16:56

Summary

Details

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that are longer than 1024 characters can used to exploit a bug in config.c::git_config_copy_or_rename_section_in_file(). This bug can be used to inject arbitrary configuration into a user's $GIT_DIR/config when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as core.pager, core.editor, core.sshCommand, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running git submodule deinit on untrusted repositories or without prior inspection of any submodule sections in $GIT_DIR/config.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.0 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-29007	REPORT
	https://ubuntu.com/security/notices/USN-6050-1	ADVISORY
	https://ubuntu.com/security/notices/USN-6050-2	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2023-29007	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-arch",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-core",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-el",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.7.4-0ubuntu1.10+esm7?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.7.4-0ubuntu1.10+esm7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.5.0-1",
        "1:2.6.2-1",
        "1:2.6.3-1",
        "1:2.6.4-1",
        "1:2.7.0~rc3-1",
        "1:2.7.0-1",
        "1:2.7.3-0ubuntu1",
        "1:2.7.4-0ubuntu1",
        "1:2.7.4-0ubuntu1.1",
        "1:2.7.4-0ubuntu1.2",
        "1:2.7.4-0ubuntu1.3",
        "1:2.7.4-0ubuntu1.4",
        "1:2.7.4-0ubuntu1.5",
        "1:2.7.4-0ubuntu1.6",
        "1:2.7.4-0ubuntu1.7",
        "1:2.7.4-0ubuntu1.8",
        "1:2.7.4-0ubuntu1.9",
        "1:2.7.4-0ubuntu1.10",
        "1:2.7.4-0ubuntu1.10+esm1",
        "1:2.7.4-0ubuntu1.10+esm3",
        "1:2.7.4-0ubuntu1.10+esm4",
        "1:2.7.4-0ubuntu1.10+esm5",
        "1:2.7.4-0ubuntu1.10+esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-el",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.17.1-1ubuntu0.18?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.17.1-1ubuntu0.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.14.1-1ubuntu4",
        "1:2.15.1-1ubuntu2",
        "1:2.17.0-1ubuntu1",
        "1:2.17.1-1ubuntu0.1",
        "1:2.17.1-1ubuntu0.3",
        "1:2.17.1-1ubuntu0.4",
        "1:2.17.1-1ubuntu0.5",
        "1:2.17.1-1ubuntu0.6",
        "1:2.17.1-1ubuntu0.7",
        "1:2.17.1-1ubuntu0.8",
        "1:2.17.1-1ubuntu0.9",
        "1:2.17.1-1ubuntu0.10",
        "1:2.17.1-1ubuntu0.11",
        "1:2.17.1-1ubuntu0.12",
        "1:2.17.1-1ubuntu0.13",
        "1:2.17.1-1ubuntu0.14",
        "1:2.17.1-1ubuntu0.15",
        "1:2.17.1-1ubuntu0.16",
        "1:2.17.1-1ubuntu0.17"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-el",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.25.1-1ubuntu3.11?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.25.1-1ubuntu3.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.20.1-2ubuntu1",
        "1:2.24.0-1ubuntu1",
        "1:2.24.0-1ubuntu2",
        "1:2.25.0-1ubuntu1",
        "1:2.25.1-1ubuntu1",
        "1:2.25.1-1ubuntu2",
        "1:2.25.1-1ubuntu3",
        "1:2.25.1-1ubuntu3.1",
        "1:2.25.1-1ubuntu3.2",
        "1:2.25.1-1ubuntu3.3",
        "1:2.25.1-1ubuntu3.4",
        "1:2.25.1-1ubuntu3.5",
        "1:2.25.1-1ubuntu3.6",
        "1:2.25.1-1ubuntu3.7",
        "1:2.25.1-1ubuntu3.8",
        "1:2.25.1-1ubuntu3.10"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.34.1-1ubuntu1.9?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.34.1-1ubuntu1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.32.0-1ubuntu1",
        "1:2.33.1-1ubuntu1",
        "1:2.34.1-1ubuntu1",
        "1:2.34.1-1ubuntu1.1",
        "1:2.34.1-1ubuntu1.2",
        "1:2.34.1-1ubuntu1.4",
        "1:2.34.1-1ubuntu1.5",
        "1:2.34.1-1ubuntu1.6",
        "1:2.34.1-1ubuntu1.8"
      ]
    }
  ],
  "aliases": [],
  "details": "Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user\u0027s `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.",
  "id": "UBUNTU-CVE-2023-29007",
  "modified": "2025-09-08T16:56:13Z",
  "published": "2023-04-25T17:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-29007"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6050-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6050-2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29007"
    }
  ],
  "related": [
    "USN-6050-1",
    "USN-6050-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-29007"
  ]
}

CVE-2023-29007 (GCVE-0-2023-29007)

Vulnerability from cvelistv5 – Published: 2023-04-25 20:09 – Updated: 2025-11-04 16:10

Title

Arbitrary configuration injection via `git submodule deinit`

Summary

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

GitHub_M

References

9 references

URL	Tags
https://github.com/git/git/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/git/git/commit/528290f8c612224…	x_refsource_MISC
https://github.com/git/git/blob/9ce9dea4e1c2419cc…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.gentoo.org/glsa/202312-15
https://lists.debian.org/debian-lts-announce/2024…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
git	git	Affected: < 2.30.9 Affected: >= 2.31.0, < 2.31.8 Affected: >= 2.32.0, < 2.32.7 Affected: >= 2.33.0, < 2.33.8 Affected: >= 2.34.0, < 2.34.8 Affected: >= 2.35.0, < 2.35.8 Affected: >= 2.36.0, < 2.36.6 Affected: >= 2.37.0, < 2.37.7 Affected: >= 2.38.0, < 2.38.5 Affected: >= 2.39.0, < 2.39.3 Affected: >= 2.40.0, < 2.40.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:10:07.750Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844"
          },
          {
            "name": "https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"
          },
          {
            "name": "https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.30.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.31.0, \u003c 2.31.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.32.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.33.0, \u003c 2.33.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.34.0, \u003c 2.34.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.35.0, \u003c 2.35.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.36.0, \u003c 2.36.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.37.0, \u003c 2.37.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.38.0, \u003c 2.38.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.39.0, \u003c 2.39.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.40.0, \u003c 2.40.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user\u0027s `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-26T10:05:57.735Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844"
        },
        {
          "name": "https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"
        },
        {
          "name": "https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202312-15"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
        }
      ],
      "source": {
        "advisory": "GHSA-v48j-4xgg-4844",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary configuration injection via `git submodule deinit`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-29007",
    "datePublished": "2023-04-25T20:09:52.182Z",
    "dateReserved": "2023-03-29T17:39:16.142Z",
    "dateUpdated": "2025-11-04T16:10:07.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-6050-1

Vulnerability from osv_ubuntu

Published

2023-05-01 09:37

Modified

2026-02-10 04:43

Summary

git vulnerabilities

Details

It was discovered that Git incorrectly handled certain commands. An attacker could possibly use this issue to overwriting some paths. (CVE-2023-25652)

Maxime Escourbiac and Yassine BENGANA discovered that Git incorrectly handled some gettext machinery. An attacker could possibly use this issue to allows the malicious placement of crafted messages. (CVE-2023-25815)

André Baptista and Vítor Pinho discovered that Git incorrectly handled certain configurations. An attacker could possibly use this issue to arbitrary configuration injection. (CVE-2023-29007)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6050-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-25652	REPORT
	https://ubuntu.com/security/CVE-2023-25815	REPORT
	https://ubuntu.com/security/CVE-2023-29007	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-25652",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-25815",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-29007",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-el",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.17.1-1ubuntu0.18"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.17.1-1ubuntu0.18?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.17.1-1ubuntu0.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.14.1-1ubuntu4",
        "1:2.15.1-1ubuntu2",
        "1:2.17.0-1ubuntu1",
        "1:2.17.1-1ubuntu0.1",
        "1:2.17.1-1ubuntu0.3",
        "1:2.17.1-1ubuntu0.4",
        "1:2.17.1-1ubuntu0.5",
        "1:2.17.1-1ubuntu0.6",
        "1:2.17.1-1ubuntu0.7",
        "1:2.17.1-1ubuntu0.8",
        "1:2.17.1-1ubuntu0.9",
        "1:2.17.1-1ubuntu0.10",
        "1:2.17.1-1ubuntu0.11",
        "1:2.17.1-1ubuntu0.12",
        "1:2.17.1-1ubuntu0.13",
        "1:2.17.1-1ubuntu0.14",
        "1:2.17.1-1ubuntu0.15",
        "1:2.17.1-1ubuntu0.16",
        "1:2.17.1-1ubuntu0.17"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-25652",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-25815",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-29007",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-el",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.25.1-1ubuntu3.11"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.25.1-1ubuntu3.11?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.25.1-1ubuntu3.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.20.1-2ubuntu1",
        "1:2.24.0-1ubuntu1",
        "1:2.24.0-1ubuntu2",
        "1:2.25.0-1ubuntu1",
        "1:2.25.1-1ubuntu1",
        "1:2.25.1-1ubuntu2",
        "1:2.25.1-1ubuntu3",
        "1:2.25.1-1ubuntu3.1",
        "1:2.25.1-1ubuntu3.2",
        "1:2.25.1-1ubuntu3.3",
        "1:2.25.1-1ubuntu3.4",
        "1:2.25.1-1ubuntu3.5",
        "1:2.25.1-1ubuntu3.6",
        "1:2.25.1-1ubuntu3.7",
        "1:2.25.1-1ubuntu3.8",
        "1:2.25.1-1ubuntu3.10"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-25652",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-25815",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-29007",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.34.1-1ubuntu1.9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.34.1-1ubuntu1.9?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.34.1-1ubuntu1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.32.0-1ubuntu1",
        "1:2.33.1-1ubuntu1",
        "1:2.34.1-1ubuntu1",
        "1:2.34.1-1ubuntu1.1",
        "1:2.34.1-1ubuntu1.2",
        "1:2.34.1-1ubuntu1.4",
        "1:2.34.1-1ubuntu1.5",
        "1:2.34.1-1ubuntu1.6",
        "1:2.34.1-1ubuntu1.8"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Git incorrectly handled certain commands.\nAn attacker could possibly use this issue to overwriting some paths.\n(CVE-2023-25652)\n\nMaxime Escourbiac and Yassine BENGANA discovered that Git incorrectly\nhandled some gettext machinery. An attacker could possibly use this issue\nto allows the malicious placement of crafted messages. (CVE-2023-25815)\n\nAndr\u00e9 Baptista and V\u00edtor Pinho discovered that Git incorrectly handled\ncertain configurations. An attacker could possibly use this issue\nto arbitrary configuration injection. (CVE-2023-29007)\n",
  "id": "USN-6050-1",
  "modified": "2026-02-10T04:43:07Z",
  "published": "2023-05-01T09:37:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6050-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-25652"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-25815"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-29007"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "git vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-25652",
    "UBUNTU-CVE-2023-25815",
    "UBUNTU-CVE-2023-29007"
  ]
}

usn-6050-2

Vulnerability from osv_ubuntu

Published

2023-05-17 13:56

Modified

2026-06-25 10:46

Summary

git vulnerabilities

Details

USN-6050-1 fixed several vulnerabilities in Git. This update provides the corresponding updates for CVE-2023-25652 and CVE-2023-29007 on Ubuntu 16.04 LTS.

Original advisory details:

It was discovered that Git incorrectly handled certain commands. An attacker could possibly use this issue to overwrite paths. (CVE-2023-25652)

André Baptista and Vítor Pinho discovered that Git incorrectly handled certain configurations. An attacker could possibly use this issue to achieve arbitrary configuration injection. (CVE-2023-29007)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6050-2	ADVISORY
	https://ubuntu.com/security/CVE-2023-25652	REPORT
	https://ubuntu.com/security/CVE-2023-29007	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-25652",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-29007",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "git",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-all",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-arch",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-core",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-cvs",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-daemon-run",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-daemon-sysvinit",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-el",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-email",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-gui",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-man",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-mediawiki",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "git-svn",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "gitk",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          },
          {
            "binary_name": "gitweb",
            "binary_version": "1:2.7.4-0ubuntu1.10+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "git",
        "purl": "pkg:deb/ubuntu/git@1:2.7.4-0ubuntu1.10+esm7?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.7.4-0ubuntu1.10+esm7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.5.0-1",
        "1:2.6.2-1",
        "1:2.6.3-1",
        "1:2.6.4-1",
        "1:2.7.0~rc3-1",
        "1:2.7.0-1",
        "1:2.7.3-0ubuntu1",
        "1:2.7.4-0ubuntu1",
        "1:2.7.4-0ubuntu1.1",
        "1:2.7.4-0ubuntu1.2",
        "1:2.7.4-0ubuntu1.3",
        "1:2.7.4-0ubuntu1.4",
        "1:2.7.4-0ubuntu1.5",
        "1:2.7.4-0ubuntu1.6",
        "1:2.7.4-0ubuntu1.7",
        "1:2.7.4-0ubuntu1.8",
        "1:2.7.4-0ubuntu1.9",
        "1:2.7.4-0ubuntu1.10",
        "1:2.7.4-0ubuntu1.10+esm1",
        "1:2.7.4-0ubuntu1.10+esm3",
        "1:2.7.4-0ubuntu1.10+esm4",
        "1:2.7.4-0ubuntu1.10+esm5",
        "1:2.7.4-0ubuntu1.10+esm6"
      ]
    }
  ],
  "aliases": [],
  "details": "USN-6050-1 fixed several vulnerabilities in Git. This update provides\nthe corresponding updates for CVE-2023-25652 and CVE-2023-29007 on\nUbuntu 16.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Git incorrectly handled certain commands.\n An attacker could possibly use this issue to overwrite paths.\n (CVE-2023-25652)\n\n Andr\u00e9 Baptista and V\u00edtor Pinho discovered that Git incorrectly handled\n certain configurations. An attacker could possibly use this issue\n to achieve arbitrary configuration injection. (CVE-2023-29007)\n",
  "id": "USN-6050-2",
  "modified": "2026-06-25T10:46:12Z",
  "published": "2023-05-17T13:56:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6050-2"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-25652"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-29007"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "git vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-25652",
    "UBUNTU-CVE-2023-29007"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2023-29007

Vulnerability from osv_ubuntu

CVE-2023-29007 (GCVE-0-2023-29007)

usn-6050-1

Vulnerability from osv_ubuntu

usn-6050-2

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature