CVE catalog

CVE-2023-25652

git: CVE-2023-25652

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
51.88% · Oct 25, 2026

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangitsid1:2.55.0-1fixed
Debiangitforky1:2.53.0-1fixed
Debiangittrixie1:2.47.3-0+deb13u1fixed
Debiangitbookworm1:2.39.5-0+deb12u3fixed
Debiangitbookworm-security1:2.39.5-0+deb12u2fixed
Alpinegit3.142.32.7-r0fixed
Alpinegit3.152.34.8-r0fixed
Alpinegit3.162.36.6-r0fixed
Alpinegit3.172.38.5-r0fixed
Alpinegit3.182.40.1-r0fixed
Alpinegit3.192.40.1-r0fixed
Alpinegit3.202.40.1-r0fixed
Alpinegit3.212.40.1-r0fixed
Alpinegit3.222.40.1-r0fixed
Alpinegit3.232.40.1-r0fixed
Alpinegit3.242.40.1-r0fixed
Ubuntugitpro1:2.5.0-1vulnerable
Ubuntugitpro1:2.6.2-1vulnerable
Ubuntugitpro1:2.6.3-1vulnerable
Ubuntugitpro1:2.6.4-1vulnerable
Ubuntugitpro1:2.7.0~rc3-1vulnerable
Ubuntugitpro1:2.7.0-1vulnerable
Ubuntugitpro1:2.7.3-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.2vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.3vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.4vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.5vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.6vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.7vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.8vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.9vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm3vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm4vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm5vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm6vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm7fixed
Ubuntugit18.041:2.14.1-1ubuntu4vulnerable
Ubuntugit18.041:2.15.1-1ubuntu2vulnerable
Ubuntugit18.041:2.17.0-1ubuntu1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.3vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.4vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.5vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.6vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.7vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.8vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.9vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.10vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.11vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.12vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.13vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.14vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.15vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.16vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.17vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.18fixed
Ubuntugit20.041:2.20.1-2ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu2vulnerable
Ubuntugit20.041:2.25.0-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.4vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.5vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.6vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.7vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.8vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.10vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.11fixed
Ubuntugit22.041:2.32.0-1ubuntu1vulnerable
Ubuntugit22.041:2.33.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.2vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.4vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.5vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.6vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.8vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.9fixed
Opensusegittumbleweed2.40.1-1.1fixed
Susegitlinux enterprise high performance computing 15 sp3-espos2.35.3-150300.10.27.1fixed
Susegitlinux enterprise high performance computing 15 sp3-ltss2.35.3-150300.10.27.1fixed
Susegitlinux enterprise server 15 sp3-ltss2.35.3-150300.10.27.1fixed
Susegitlinux enterprise server for sap applications 15 sp32.35.3-150300.10.27.1fixed
Susegitmanager proxy 4.22.35.3-150300.10.27.1fixed
Susegitmanager server 4.22.35.3-150300.10.27.1fixed
Susegitenterprise storage 7.12.35.3-150300.10.27.1fixed
Susegithpe helion openstack 82.26.2-27.69.1fixed
Susegitopenstack cloud 82.26.2-27.69.1fixed
Susegitopenstack cloud 92.26.2-27.69.1fixed
Susegitopenstack cloud crowbar 92.26.2-27.69.1fixed
Susegitlinux enterprise server for sap applications 12 sp42.26.2-27.69.1fixed
Susegitlinux enterprise software development kit 12 sp52.26.2-27.69.1fixed
Susegitlinux enterprise server 12 sp2-bcl2.26.2-27.69.1fixed
Susegitlinux enterprise server 12 sp4-espos2.26.2-27.69.1fixed
Susegitlinux enterprise server 12 sp4-ltss2.26.2-27.69.1fixed
Susegitlinux enterprise server 12 sp52.26.2-27.69.1fixed
Susegitlinux enterprise server for sap applications 12 sp52.26.2-27.69.1fixed
Ubuntugitpro1:2.5.0-1vulnerable
Ubuntugitpro1:2.6.2-1vulnerable
Ubuntugitpro1:2.6.3-1vulnerable
Ubuntugitpro1:2.6.4-1vulnerable
Ubuntugitpro1:2.7.0~rc3-1vulnerable
Ubuntugitpro1:2.7.0-1vulnerable
Ubuntugitpro1:2.7.3-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.2vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.3vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.4vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.5vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.6vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.7vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.8vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.9vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm1vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm3vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm4vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm5vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm6vulnerable
Ubuntugitpro1:2.7.4-0ubuntu1.10+esm7fixed
Ubuntugit18.041:2.14.1-1ubuntu4vulnerable
Ubuntugit18.041:2.15.1-1ubuntu2vulnerable
Ubuntugit18.041:2.17.0-1ubuntu1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.3vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.4vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.5vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.6vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.7vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.8vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.9vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.10vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.11vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.12vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.13vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.14vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.15vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.16vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.17vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.18fixed
Ubuntugit20.041:2.20.1-2ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu2vulnerable
Ubuntugit20.041:2.25.0-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.4vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.5vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.6vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.7vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.8vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.10vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.11fixed
Ubuntugit22.041:2.32.0-1ubuntu1vulnerable
Ubuntugit22.041:2.33.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.2vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.4vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.5vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.6vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.8vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.9fixed
Susegitlinux enterprise module for basesystem 15 sp42.35.3-150300.10.27.1fixed
Susegitlinux enterprise module for development tools 15 sp42.35.3-150300.10.27.1fixed
Susegitlinux enterprise real time 15 sp32.35.3-150300.10.27.1fixed
Opensusegitleap 15.42.35.3-150300.10.27.1fixed
Susegitlinux enterprise high performance computing 15 sp1-ltss2.26.2-150000.50.1fixed
Susegitlinux enterprise high performance computing 15 sp2-ltss2.26.2-150000.50.1fixed
Susegitlinux enterprise server 15 sp1-ltss2.26.2-150000.50.1fixed
Susegitlinux enterprise server 15 sp2-ltss2.26.2-150000.50.1fixed
Susegitlinux enterprise server for sap applications 15 sp12.26.2-150000.50.1fixed
Susegitlinux enterprise server for sap applications 15 sp22.26.2-150000.50.1fixed
Susegitenterprise storage 72.26.2-150000.50.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangitsourcesid1:2.40.1-1not yet assignedNot reported[1034835]
Debiangitsourceforky1:2.40.1-1not yet assignedNot reported[1034835]
Debiangitsourcetrixie1:2.40.1-1not yet assignedNot reported[1034835]
Debiangitsourcebookworm1:2.39.5-0+deb12u1not yet assignedNot reported[1034835]
Alpinegitapk3.142.32.7-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.152.34.8-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.162.36.6-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.172.38.5-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.182.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.192.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.202.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.212.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.222.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.232.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Alpinegitapk3.242.40.1-r0Not reportedALPINE-CVE-2023-25652Not reported
Ubuntugitdebpro1:2.7.4-0ubuntu1.10+esm7Not reportedUSN-6050-2Not reported
Ubuntugitdeb18.041:2.17.1-1ubuntu0.18Not reportedUSN-6050-1Not reported
Ubuntugitdeb20.041:2.25.1-1ubuntu3.11Not reportedUSN-6050-1Not reported
Ubuntugitdeb22.041:2.34.1-1ubuntu1.9Not reportedUSN-6050-1Not reported
Opensusegitrpmtumbleweed2.40.1-1.1Not reportedOPENSUSE-SU-2024:12889-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp3-espos2.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmlinux enterprise high performance computing 15 sp3-ltss2.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmlinux enterprise server 15 sp3-ltss2.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmlinux enterprise server for sap applications 15 sp32.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmmanager proxy 4.22.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmmanager server 4.22.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmenterprise storage 7.12.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-2Not reported
Susegitrpmhpe helion openstack 82.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmopenstack cloud 82.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmopenstack cloud 92.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmopenstack cloud crowbar 92.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise server for sap applications 12 sp42.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise software development kit 12 sp52.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise server 12 sp2-bcl2.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise server 12 sp4-espos2.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise server 12 sp4-ltss2.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise server 12 sp52.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Susegitrpmlinux enterprise server for sap applications 12 sp52.26.2-27.69.1Not reportedSUSE-SU-2023:2062-1Not reported
Ubuntugitdebpro1:2.7.4-0ubuntu1.10+esm7Not reportedUBUNTU-CVE-2023-25652Not reported
Ubuntugitdeb18.041:2.17.1-1ubuntu0.18Not reportedUBUNTU-CVE-2023-25652Not reported
Ubuntugitdeb20.041:2.25.1-1ubuntu3.11Not reportedUBUNTU-CVE-2023-25652Not reported
Ubuntugitdeb22.041:2.34.1-1ubuntu1.9Not reportedUBUNTU-CVE-2023-25652Not reported
Susegitrpmlinux enterprise module for basesystem 15 sp42.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-1Not reported
Susegitrpmlinux enterprise module for development tools 15 sp42.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-1Not reported
Susegitrpmlinux enterprise real time 15 sp32.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-1Not reported
Opensusegitrpmleap 15.42.35.3-150300.10.27.1Not reportedSUSE-SU-2023:2038-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp1-ltss2.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp2-ltss2.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported
Susegitrpmlinux enterprise server 15 sp1-ltss2.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported
Susegitrpmlinux enterprise server 15 sp2-ltss2.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported
Susegitrpmlinux enterprise server for sap applications 15 sp12.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported
Susegitrpmlinux enterprise server for sap applications 15 sp22.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported
Susegitrpmenterprise storage 72.26.2-150000.50.1Not reportedSUSE-SU-2023:2081-1Not reported

[Debian bug #1034835]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References