{"affected":[{"product":"git","source":"CNA: GitHub_M","vendor":"git","versions":[{"status":"affected","version":"< 2.30.9"},{"status":"affected","version":">= 2.31.0, < 2.31.8"},{"status":"affected","version":">= 2.32.0, < 2.32.7"},{"status":"affected","version":">= 2.33.0, < 2.33.8"},{"status":"affected","version":">= 2.34.0, < 2.34.8"},{"status":"affected","version":">= 2.35.0, < 2.35.8"},{"status":"affected","version":">= 2.36.0, < 2.36.6"},{"status":"affected","version":">= 2.37.0, < 2.37.7"},{"status":"affected","version":">= 2.38.0, < 2.38.5"},{"status":"affected","version":">= 2.39.0, < 2.39.3"},{"status":"affected","version":">= 2.40.0, < 2.40.1"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.9","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.31.8","versionStartIncluding":"2.31.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.32.7","versionStartIncluding":"2.32.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.33.8","versionStartIncluding":"2.33.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.34.8","versionStartIncluding":"2.34.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.35.8","versionStartIncluding":"2.35.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.36.5","versionStartIncluding":"2.36.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.37.7","versionStartIncluding":"2.37.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.38.5","versionStartIncluding":"2.38.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.39.3","versionStartIncluding":"2.39.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:2.40.0:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2023-29007","cwes":["CWE-74"],"description":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.","epss":{"date":"2026-11-02","percentile":0.92917,"score":0.05609},"exploits":[],"kev":null,"metrics":[{"score":7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.8,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793661435807,"publishedAt":1682453392182,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt"},{"source":"CNA: GitHub_M","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"},{"source":"CNA: GitHub_M","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"},{"source":"CNA: GitHub_M","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"},{"source":"CNA: GitHub_M","tags":[],"url":"https://security.gentoo.org/glsa/202312-15"},{"source":"CNA: GitHub_M","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"},{"source":"ADP: CVE","tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844"},{"source":"ADP: CVE","tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"},{"source":"ADP: CVE","tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://security.gentoo.org/glsa/202312-15"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt"},{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844"},{"source":"security-advisories@github.com","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"},{"source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"},{"source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"},{"source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"},{"source":"security-advisories@github.com","tags":["Third Party Advisory"],"url":"https://security.gentoo.org/glsa/202312-15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://security.gentoo.org/glsa/202312-15"}],"remediation":[{"kind":"fix","source":"security-advisories@github.com","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"},{"kind":"fix","source":"af854a3a-2127-422b-91ae-364da2661108","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4"}],"revision":"43a00f3a8b872cec01357925e9b5c50397bfe4e7611db7a0198ca7ab1e93a21f","sources":[{"modifiedAt":1793658768199,"name":"CNA: GitHub_M","retrievedAt":1793660916462,"url":"https://www.cve.org/CVERecord?id=CVE-2023-29007"},{"modifiedAt":1793661435807,"name":"NVD","retrievedAt":1793665085710,"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29007"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793660921984,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29007"}],"ssvc":{"assessedAt":1705962944903,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Arbitrary configuration injection via `git submodule deinit`","updatedAt":1793665085710}