vulnerability

FreeBSD: VID-8fafbef4-b1d9-11ed-b0f4-002590f2a714 (CVE-2022-23521): git -- gitattributes parsing integer overflow

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Feb 21, 2023
Added
Feb 22, 2023
Modified
Dec 10, 2025

Description

git team reports: gitattributes are used to define unique attributes corresponding to paths in your repository. These attributes are defined by .gitattributes file(s) within your repository. The parser used to read these files has multiple integer overflows, which can occur when parsing either a large number of patterns, a large number of attributes, or attributes with overly-long names. These overflows may be triggered via a malicious .gitattributes file. However, Git automatically splits lines at 2KB when reading .gitattributes from a file, but not when parsing it from the index. Successfully exploiting this vulnerability depends on the location of the .gitattributes file in question. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution.

Solution

freebsd-upgrade-package-git
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.