CVE-2022-29187
Summary
| CVE | CVE-2022-29187 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-07-12 21:15:00 UTC |
| Updated | 2024-01-14 10:15:00 UTC |
| Description | Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks. |
Risk And Classification
Problem Types: CWE-427 | CWE-282
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apple | Xcode | All | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Operating System | Fedoraproject | Fedora | 36 | All | All | All |
| Operating System | Fedoraproject | Fedora | 37 | All | All | All |
| Application | Git-scm | Git | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 37 Update: libgit2-1.3.2-1.fc37 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: git-2.37.1-1.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: rust-cargo-c-0.9.12-3.fc37 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| Full Disclosure: APPLE-SA-2022-11-01-1 Xcode 14.1 | FULLDISC | seclists.org | |
| Bypass of safe.directory protections · Advisory · git/git · GitHub | CONFIRM | github.com | |
| oss-security - Git v2.37.1 and friends for CVE-2022-29187 | MLIST | www.openwall.com | |
| libgit2: Privilege Escalation Vulnerability (GLSA 202401-17) — Gentoo security | security.gentoo.org | ||
| [SECURITY] Fedora 36 Update: libgit2-1.3.2-1.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: libgit2-1.3.2-1.fc37 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Git security vulnerability announced | The GitHub Blog | MISC | github.blog | |
| [SECURITY] Fedora 36 Update: rust-bat-0.21.0-6.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] [DLA 3239-1] git security update | MLIST | lists.debian.org | |
| [ANNOUNCE] Git v2.37.1 and others | lore.kernel.org | ||
| Git: Multiple Vulnerabilities (GLSA 202312-15) — Gentoo security | security.gentoo.org | ||
| [SECURITY] Fedora 36 Update: git-2.37.1-1.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 36 Update: rust-bat-0.21.0-6.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: git-2.37.1-1.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [ANNOUNCE] Git v2.37.1 and others | MISC | lore.kernel.org | |
| [SECURITY] Fedora 35 Update: git-2.37.1-1.fc35 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: libgit2-1.3.2-1.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| About the security content of Xcode 14.1 - Apple Support | CONFIRM | support.apple.com | |
| [SECURITY] Fedora 37 Update: rust-cargo-c-0.9.12-3.fc37 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160630 Oracle Enterprise Linux Security Update for git (ELSA-2023-2319)
- 160657 Oracle Enterprise Linux Security Update for git (ELSA-2023-2859)
- 181320 Debian Security Update for git (DLA 3239-1)
- 181321 Debian Security Update for git (DLA 3239-2)
- 181518 Debian Security Update for git (DSA 5332-1)
- 182337 Debian Security Update for git (CVE-2022-29187)
- 198856 Ubuntu Security Notification for Git Vulnerabilities (USN-5511-1)
- 241436 Red Hat Update for git (RHSA-2023:2319)
- 241487 Red Hat Update for git (RHSA-2023:2859)
- 242859 Red Hat Update for git (RHSA-2024:0407)
- 282953 Fedora Security Update for git (FEDORA-2022-dfd7e7fc0e)
- 282985 Fedora Security Update for git (FEDORA-2022-2a5de7cb8b)
- 283637 Fedora Security Update for libgit2 (FEDORA-2023-470c7ea49e)
- 283645 Fedora Security Update for rust (FEDORA-2023-e3c8abd37e)
- 283646 Fedora Security Update for libgit2 (FEDORA-2023-1068309389)
- 283652 Fedora Security Update for rust (FEDORA-2023-3ec32f6d4e)
- 354010 Amazon Linux Security Advisory for git : ALAS2-2022-1820
- 354034 Amazon Linux Security Advisory for git : ALAS-2022-1623
- 354337 Amazon Linux Security Advisory for git : ALAS2022-2022-118
- 354445 Amazon Linux Security Advisory for git : ALAS2022-2022-236
- 354589 Amazon Linux Security Advisory for git : ALAS-2022-236
- 355256 Amazon Linux Security Advisory for git : ALAS2023-2023-065
- 377735 Apple Xcode Prior to 14.1 Vulnerabilities (HT213496)
- 379406 Git for Windows Multiple Security Vulnerability (CVE-2022-29187,CVE-2022-31012)
- 502431 Alpine Linux Security Update for git
- 502432 Alpine Linux Security Update for git
- 502433 Alpine Linux Security Update for git
- 502434 Alpine Linux Security Update for git
- 502725 Alpine Linux Security Update for git
- 502876 Alpine Linux Security Update for libgit2
- 672092 EulerOS Security Update for git (EulerOS-SA-2022-2286)
- 672103 EulerOS Security Update for git (EulerOS-SA-2022-2315)
- 672200 EulerOS Security Update for git (EulerOS-SA-2022-2459)
- 672263 EulerOS Security Update for git (EulerOS-SA-2022-2680)
- 672266 EulerOS Security Update for git (EulerOS-SA-2022-2648)
- 690897 Free Berkeley Software Distribution (FreeBSD) Security Update for git (b99f99f6-021e-11ed-8c6f-000c29ffbb6c)
- 710816 Gentoo Linux Git Multiple Vulnerabilities (GLSA 202312-15)
- 710835 Gentoo Linux libgit2 Privilege Escalation Vulnerability (GLSA 202401-17)
- 752375 SUSE Enterprise Linux Security Update for git (SUSE-SU-2022:2535-1)
- 752381 SUSE Enterprise Linux Security Update for git (SUSE-SU-2022:2537-1)
- 752392 SUSE Enterprise Linux Security Update for git (SUSE-SU-2022:2550-1)
- 752650 SUSE Enterprise Linux Security Update for libgit2 (SUSE-SU-2022:3494-1)
- 752654 SUSE Enterprise Linux Security Update for libgit2 (SUSE-SU-2022:3495-1)
- 753386 SUSE Enterprise Linux Security Update for libgit2 (SUSE-SU-2022:3283-1)
- 941032 AlmaLinux Security Update for git (ALSA-2023:2319)
- 941077 AlmaLinux Security Update for git (ALSA-2023:2859)