<p>Upgrade <code>Alpine:3.16</code> <code>git</code> to version 2.36.6-r0 or higher.</p>

Directory Traversal Affecting git package, versions <2.36.6-r0

Threat Intelligence

0.3% (70^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALPINE316-GIT-5461981
published 26 Apr 2023
disclosed 25 Apr 2023

Report a new vulnerability Found a mistake?

Introduced: 25 Apr 2023

CVE-2023-25652 Open this link in a new tab CWE-22 Open this link in a new tab

How to fix?

Upgrade Alpine:3.16 git to version 2.36.6-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Alpine. See How to fix? for Alpine:3.16 relevant fixed versions and status.

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using git apply with --reject when applying patches from an untrusted source. Use git apply --stat to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the *.rej file exists.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

High
Availability (A)

None

Directory Traversal Affecting git package, versions <2.36.6-r0

Severity

Snyk's Security Team recommends NVD's CVSS assessment