Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8…
| Vendor | Product | Versions |
|---|---|---|
| git | git | < 2.30.9, >= 2.31.0, < 2.31.8, >= 2.32.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.8, >= 2.35.0, < 2.35.8, >= 2.36.0, < 2.36.6, >= 2.37.0, < 2.37.7, >= 2.38.0, < 2.38.5, >= 2.39.0, < 2.39.3, >= 2.40.0, < 2.40.1 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.