{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2023-25815", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-02-15T16:34:48.773Z", "datePublished": "2023-04-25T19:51:38.433Z", "dateUpdated": "2024-08-02T11:32:12.304Z"}, "containers": {"cna": {"title": "Git looks for localized messages in the wrong place", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-134", "lang": "en", "description": "CWE-134: Use of Externally-Controlled Format String", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"}, {"name": "https://github.com/msys2/MINGW-packages/pull/10461", "tags": ["x_refsource_MISC"], "url": "https://github.com/msys2/MINGW-packages/pull/10461"}, {"name": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack", "tags": ["x_refsource_MISC"], "url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"}, {"name": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"}, {"name": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html", "tags": ["x_refsource_MISC"], "url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"}, {"url": "http://www.openwall.com/lists/oss-security/2023/04/25/2"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"}, {"url": "https://security.gentoo.org/glsa/202312-15"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"}], "affected": [{"vendor": "git-for-windows", "product": "git", "versions": [{"version": "< 2.40.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-25T19:51:38.433Z"}, "descriptions": [{"lang": "en", "value": "In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\n\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`."}], "source": {"advisory": "GHSA-9w66-8mq8-5vm8", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:32:12.304Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"}, {"name": "https://github.com/msys2/MINGW-packages/pull/10461", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/msys2/MINGW-packages/pull/10461"}, {"name": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"}, {"name": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"}, {"name": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"}, {"url": "http://www.openwall.com/lists/oss-security/2023/04/25/2", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202312-15", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:git_for_windows_project:git_for_windows:*:*:*:*:*:*:*:*", "matchCriteriaId": "E740B447-D96A-40C3-AFA9-9B058379E04D", "versionEndExcluding": "2.40.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\n\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`."}, {"lang": "es", "value": "En Git para Windows, la versi\u00f3n de Git para Windows, no se env\u00edan mensajes localizados con el instalador. Como consecuencia, se espera que Git no localice ning\u00fan mensaje y omita la inicializaci\u00f3n de gettext. Sin embargo, debido a un cambio en los paquetes MINGW, la inicializaci\u00f3n impl\u00edcita de la funci\u00f3n `gettext()` ya no usa el prefijo de tiempo de ejecuci\u00f3n sino que usa la ruta codificada `C:\\mingw64\\share\\locale` para buscar mensajes localizados. Y dado que cualquier usuario autenticado tiene permiso para crear carpetas en `C:\\` (y dado que `C:\\mingw64` normalmente no existe), es posible que los usuarios con pocos privilegios coloquen mensajes falsos en esa ubicaci\u00f3n donde `git .exe` los recoger\u00e1 en la versi\u00f3n 2.40.1. Esta vulnerabilidad es relativamente dif\u00edcil de explotar y requiere ingenier\u00eda social. Por ejemplo, un mensaje leg\u00edtimo al final de un clon podr\u00eda modificarse maliciosamente para pedirle al usuario que dirija su navegador web a un sitio web malicioso, y el usuario podr\u00eda pensar que el mensaje proviene de Git y es leg\u00edtimo. Sin embargo, requiere acceso de escritura local por parte del atacante, lo que hace que este vector de ataque sea menos probable. La versi\u00f3n 2.40.1 contiene un parche para este problema. Algunas soluciones est\u00e1n disponibles. No trabaje en una m\u00e1quina Windows con cuentas compartidas o, alternativamente, cree una carpeta `C:\\mingw64` y d\u00e9jela vac\u00eda. Los usuarios que tienen derechos administrativos pueden eliminar el permiso para crear carpetas en `C:\\`."}], "id": "CVE-2023-25815", "lastModified": "2024-06-26T10:15:11.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-04-25T20:15:09.997", "references": [{"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/04/25/2"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/msys2/MINGW-packages/pull/10461"}, {"source": "security-advisories@github.com", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"}, {"source": "security-advisories@github.com", "url": "https://security.gentoo.org/glsa/202312-15"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}, {"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-134"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2023:3246", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "git-0:2.39.3-1.el8_8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-05-22T00:00:00Z"}, {"advisory": "RHSA-2023:3192", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "git-0:2.18.4-3.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2023-05-17T00:00:00Z"}, {"advisory": "RHSA-2023:3382", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "git-0:2.18.4-4.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2023-05-31T00:00:00Z"}, {"advisory": "RHSA-2023:3243", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "git-0:2.27.0-4.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2023-05-22T00:00:00Z"}, {"advisory": "RHSA-2023:3247", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "git-0:2.31.1-4.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-05-22T00:00:00Z"}, {"advisory": "RHSA-2023:3245", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "git-0:2.39.3-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-22T00:00:00Z"}, {"advisory": "RHSA-2023:3248", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "git-0:2.31.1-5.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-05-22T00:00:00Z"}, {"advisory": "RHSA-2023:3280", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-git227-git-0:2.27.0-6.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2023-05-23T00:00:00Z"}], "bugzilla": {"description": "git: malicious placement of crafted messages when git was compiled with runtime prefix", "id": "2188337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188337"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "status": "verified"}, "details": ["In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`.", "A vulnerability was found in Git. This security flaw occurs when Git compiles with runtime prefix support and runs without translated messages, and it still uses the gettext machinery to display messages, which subsequently looks for translated messages in unexpected places. This flaw allows the malicious placement of crafted messages."], "name": "CVE-2023-25815", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-04-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-25815\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-25815"], "threat_severity": "Low"}