vulnerability
FreeBSD: VID-8fafbef4-b1d9-11ed-b0f4-002590f2a714 (CVE-2022-23521): git -- gitattributes parsing integer overflow
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Feb 21, 2023 | Feb 22, 2023 | Dec 10, 2025 |
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Feb 21, 2023
Added
Feb 22, 2023
Modified
Dec 10, 2025
Description
git team reports: gitattributes are used to define unique attributes corresponding to paths in your repository. These attributes are defined by .gitattributes file(s) within your repository. The parser used to read these files has multiple integer overflows, which can occur when parsing either a large number of patterns, a large number of attributes, or attributes with overly-long names. These overflows may be triggered via a malicious .gitattributes file. However, Git automatically splits lines at 2KB when reading .gitattributes from a file, but not when parsing it from the index. Successfully exploiting this vulnerability depends on the location of the .gitattributes file in question. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution.
Solution
freebsd-upgrade-package-git
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.