git: Heap overflow in `git archive`, `git log --format` leading to RCE

🗓️ 10 Apr 2023 02:03:40Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Git heap overflow in commit formatting and archive export-subst may allow arbitrary code execution.

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	30 Mar 202315:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Git [CVE-2022-41903]	6 Apr 202319:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.4.5 addresses multiple security vulnerabilities	17 Apr 202313:48	–	ibm
FreeBSD	git -- Heap overflow in `git archive`, `git log --format` leading to RCE	17 Jan 202300:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2023-065)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : git, git-all, git-core (ALAS-2023-1923)	6 Feb 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : emacs-git, emacs-git-el, git (ALAS-2023-1679)	6 Feb 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0020: git (ALINUX3-SA-2023:0020)	14 May 202500:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	x86_64	redhat-virtualization-host-image-update	4.5.3-202304051438_8.6	redhat-virtualization-host-image-update-4.5.3-202304051438_8.6.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-41903
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/git/git/files/10430260/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf
github	www.github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-41903
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2023/01/17/4

28 Jun 2026 12:38Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

EPSS0.44268

SSVC

git archive commit formatting export substitution integer overflow heap overflow remote code execution arbitrary code execution memory copy