Medium severity6.2NVD Advisory· Published Feb 14, 2023· Updated Jun 17, 2026
CVE-2023-23946
CVE-2023-23946
Description
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the working tree can be overwritten as the user who is running git apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
62- osv-coords59 versionspkg:apk/wolfi/git-iamguarded-compatpkg:apk/wolfi/gitpkg:apk/chainguard/git-iamguarded-compatpkg:rpm/almalinux/perl-Gitpkg:rpm/suse/git&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:apk/wolfi/git-docpkg:apk/chainguard/git-docpkg:apk/wolfi/git-daemonpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:apk/wolfi/git-emailpkg:apk/chainguard/git-p4pkg:rpm/almalinux/git-core-docpkg:rpm/almalinux/git-allpkg:apk/chainguard/git-completionpkg:rpm/almalinux/git-svnpkg:rpm/almalinux/git-guipkg:rpm/almalinux/git-subtreepkg:rpm/almalinux/gitkpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/opensuse/git&distro=openSUSE%20Tumbleweedpkg:apk/wolfi/git-completionpkg:apk/chainguard/git-daemonpkg:rpm/almalinux/git-emailpkg:rpm/almalinux/gitwebpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/git&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.2pkg:apk/wolfi/git-p4pkg:rpm/almalinux/git-corepkg:rpm/almalinux/perl-Git-SVNpkg:rpm/almalinux/git-credential-libsecretpkg:rpm/almalinux/git-daemonpkg:rpm/almalinux/git-instawebpkg:rpm/suse/git&distro=SUSE%20Manager%20Proxy%204.2pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/git&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/git&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/git&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/opensuse/git&distro=openSUSE%20Leap%2015.4pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:apk/chainguard/git-emailpkg:rpm/suse/git&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/almalinux/gitpkg:rpm/suse/git&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/git&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/git&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:apk/chainguard/git
< 2.39.2-r1+ 58 more
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.39.2-1.1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.39.2-r1
- (no CPE)range: < 2.35.3-150300.10.24.1
- (no CPE)range: < 2.26.2-150000.47.1
- (no CPE)range: < 2.39.3-1.el9_2
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.26.2-27.66.1
- (no CPE)range: < 2.39.2-r1
<2.39.2, <2.38.4, <2.37.6, <2.36.5, <2.35.7, <2.34.7, <2.33.7, <2.32.6, <2.31.7, <2.30.8+ 2 more
- (no CPE)range: <2.39.2, <2.38.4, <2.37.6, <2.36.5, <2.35.7, <2.34.7, <2.33.7, <2.32.6, <2.31.7, <2.30.8
- cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*range: <2.30.8
- (no CPE)range: >= 2.39.0, < 2.39.2
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.