dbcve.org
GitApplication · Git Scm

CVE-2022-39253

MEDIUM · 5.5 CVSS v3.1 Published 2022-10-19
Fix available
A fix is available. Upgrade to 2.30.6 / 2.31.5 or later.
See remediation →
58/100
Remediation priority · Elevated
No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Git's local clone optimization (hardlink or copy of objects directory) follows symbolic links, allowing a malicious repository with symlinks in its objects directory to reference sensitive files outside the repository, enabling information disclosure when a victim performs a local clone.

MitigationUpdate Git to versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, 2.37.4 or later. Alternatively, use --no-local or file:// scheme when cloning untrusted repositories, or set protocol.file.allow user.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
GitApplication
Affected:< 2.30.6>= 2.31.0, < 2.31.5>= 2.32.0, < 2.32.4>= 2.33.0, < 2.33.5>= 2.34.0, < 2.34.5>= 2.35.0, < 2.35.5>= 2.36.0, < 2.36.3>= 2.37.0, < 2.37.4= 2.38.0
FedoraOperating system
Affected:= 35= 36= 37
Debian LinuxOperating system
Affected:= 10.0
XcodeApplication
Affected:< 14.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check installed Git version
    Run `git --version` to obtain the exact version number, then compare against affected ranges: < 2.30.6; >= 2.31.0, < 2.31.5; >= 2.32.0, < 2.32.4; >= 2.33.0, < 2.33.5; >= 2.34.0, < 2.34.5; >= 2.35.0, < 2.35.5; >= 2.36.0, < 2.36.3; >= 2.37.0, < 2.37.4; = 2.38.0
    Affected if The installed version falls within any of the listed affected ranges
  2. Verify local clone protocol configuration
    Run `git config --get protocol.file.allow` to check the current setting for file:// protocol
    Affected if The value is set to 'always' or 'user', which permits local clone optimizations on untrusted repositories
  3. Check for untrusted local repositories
    Identify any repositories cloned from untrusted local sources (file:// URLs, local paths from other users or external media) using `git remote -v` and examining the source location
    Affected if Local clones exist from sources that are not fully trusted or are from untrusted origins
  4. Audit objects directory for unexpected symlinks
    If local clones exist, inspect the .git/objects directory in those repositories for symbolic links pointing outside the repository tree using `find .git/objects -type l -ls`
    Affected if Symbolic links are found in objects directory pointing to paths outside the repository

You are affected if your Git version is in the affected list AND you clone or work with repositories from local/untrusted sources where a malicious objects directory with symlinks could be present.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2.30.6 / 2.31.5 / 2.32.4 or later
Fixed in 2.30.62.31.52.32.4
Interim mitigation

Update Git to versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, 2.37.4 or later. Alternatively, use --no-local or file:// scheme when cloning untrusted repositories, or set protocol.file.allow user.

Recommended fix High confidence

Upgrade to Git 2.30.6, 2.31.5, 2.32.4, 2.33.5, or 2.37.4 (or later) - choose the version matching your current branch

  1. Check current Git version by running `git --version`
  2. Identify the appropriate fixed version based on your current Git branch (e.g., for 2.30.x use 2.30.6+, for 2.31.x use 2.31.5+, for 2.32.x use 2.32.4+, for 2.33.x use 2.33.5+, or upgrade to the latest stable 2.37.4 or later)
  3. Upgrade Git using your system's package manager (e.g., `apt-get update && apt-get install git` on Debian/Ubuntu, `dnf update git` on Fedora, or brew on macOS)
  4. Verify the upgrade was successful by running `git --version` again
  5. For immediate mitigation without upgrading, always use `--no-local` flag when cloning untrusted repositories (e.g., `git clone --no-local <repo>`) or use `file://` scheme (e.g., `git clone file:///path/to/repo`)
  6. Alternatively, run `git config --global protocol.file.allow user` to disable the local file protocol by default
Caveat Minimal risk; upgrading Git is generally safe but test in non-production environment first as with any software update

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Git Scoped from the published advisory
  • Consultation1.0 h
  • Implementation1.0 h
  • Testing1.0 h
  • Review / QA1.0 h
4.0 hours of engineering $750
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,200.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-39253 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-39253 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data