medium 5.5

CVE-2022-39253 json

Git subject to exposure of sensitive information via local clone of symbolic links

published 2022-10-19 4y ago modified 2026-06-17 4mo ago also EUVD-2022-41767

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.

Patch / fix

fixed in 2 distros 7

git-scm git 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, 2.37.4
apple xcode 14.1

debian ubuntu red hat suse opensuse almalinux alpine

git Debian 14, Debian 13, Debian 12 1:2.38.1-1

debian advisories DEBIAN-CVE-2022-39253

git Ubuntu 18.04 LTS 1:2.17.1-1ubuntu0.13
git Ubuntu 20.04 LTS 1:2.25.1-1ubuntu3.6
git Ubuntu 22.04 LTS 1:2.34.1-1ubuntu1.5
git Ubuntu Pro 16.04 LTS 1:2.7.4-0ubuntu1.10+esm6

ubuntu advisories UBUNTU-CVE-2022-39253

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

git RHEL 8 2.39.1-1.el8
gitk RHEL 8 2.39.1-1.el8
gitweb RHEL 8 2.39.1-1.el8
git-all RHEL 8 2.39.1-1.el8
git-gui RHEL 8 2.39.1-1.el8
git-svn RHEL 8 2.39.1-1.el8
git-core RHEL 8 2.39.1-1.el8
perl-Git RHEL 8 2.39.1-1.el8

red hat advisories RHSA-2024:0407 RHSA-2023:2859 RHSA-2023:2319

git SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +5 more 2.26.2-150000.47.1
git SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 +2 more 2.26.2-27.60.1
git SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, SLE Module for Basesystem 15 SP4 +3 more 2.35.3-150300.10.18.1

suse advisories SUSE-SU-2023:0418-1 SUSE-SU-2022:4271-1 SUSE-SU-2022:3931-1

perl-Git-Repository openSUSE Tumbleweed 1.326.0-1.1
docker-compose openSUSE Tumbleweed 2.12.2-1.1
git openSUSE Tumbleweed 2.38.1-1.1
reuse openSUSE Tumbleweed 1.1.2-1.1

opensuse advisories openSUSE-SU-2026:10987-1 openSUSE-SU-2024:12430-1 openSUSE-SU-2024:12487-1 openSUSE-SU-2024:12851-1

git AlmaLinux 8 2.39.1-1.el8
gitk AlmaLinux 8 2.39.1-1.el8
gitweb AlmaLinux 8 2.39.1-1.el8
git-all AlmaLinux 8 2.39.1-1.el8
git-gui AlmaLinux 8 2.39.1-1.el8
git-svn AlmaLinux 8 2.39.1-1.el8
git-core AlmaLinux 8 2.39.1-1.el8
perl-Git AlmaLinux 8 2.39.1-1.el8

almalinux advisories ALSA-2023:2859 ALSA-2023:2319

git Alpine 3.13 2.30.6-r0
git Alpine 3.14 2.32.4-r0
git Alpine 3.15 2.34.5-r0
git Alpine 3.16 2.36.3-r0
git Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.38.1-r0
docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 20.10.20-r0
docker-cli-compose Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 2.12.1-r0

alpine advisories ALPINE-CVE-2022-39253

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2022-39253 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-39253 updated 2026-11-05 cvss 5.5

git: exposure of sensitive information to a malicious actor

Red Hat Enterprise Linux 6 git, gitk, gitweb, git-all, git-cvs, git-gui, +6 more Red Hat Enterprise Linux 7 git, gitk, git-hg, git-p4, gitweb, git-all, +12 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Software Collections rh-git227-git, rh-git227-gitk, rh-git227-git-p4, rh-git227-gitweb, rh-git227-git-all, rh-git227-git-cvs, +10 more
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) git 2.39.1-1.el8, gitk 2.39.1-1.el8, gitweb 2.39.1-1.el8, git-all 2.39.1-1.el8, git-gui 2.39.1-1.el8, git-svn 2.39.1-1.el8, +8 more
fixed: vendor fix RHSA-2023:2859
Red Hat Enterprise Linux AppStream (v. 9) git 2.39.1-1.el9, gitk 2.39.1-1.el9, gitweb 2.39.1-1.el9, git-all 2.39.1-1.el9, git-gui 2.39.1-1.el9, git-svn 2.39.1-1.el9, +8 more
fixed: vendor fix RHSA-2023:2319
Red Hat Enterprise Linux AppStream EUS (v.8.6) git 2.31.8-1.el8_6, gitk 2.31.8-1.el8_6, gitweb 2.31.8-1.el8_6, git-all 2.31.8-1.el8_6, git-gui 2.31.8-1.el8_6, git-svn 2.31.8-1.el8_6, +8 more
fixed: vendor fix RHSA-2024:0407

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

git git

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-59 Improper Link Resolution Before File Access

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/
vendor-advisory
security.gentoo.org /glsa/202312-15
vendor-advisory
github.com /git/git/security/advisories/GHSA-3wp6-j8xr-qw85
mitigation, third-party-advisory
support.apple.com /kb/HT213496
third-party-advisory
seclists.org /fulldisclosure/2022/Nov/1
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2022/12/msg00025.html
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2023/02/14/5
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2024/05/14/2
mailing-list

Sources

CVE List CVE-2022-39253
NVD CVE-2022-39253

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed