Likely permanent: GitHub doesn’t review this ecosystem
GHSA-v48j-4xgg-4844
git on - · published in git/git
Facts
- Severity
- High · CVSS score 7.0CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Affected versions
- <= v2.30.8, v2.31.7, v2.32.6, v2.33.7, v2.34.7, v2.35.7, v2.36.5, v2.37.6, v2.38.4, v2.39.2 and v2.40.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
- Fixed in
- >= v2.30.9, v2.31.8, v2.32.7, v2.33.8, v2.34.8, v2.35.8, v2.36.6, v2.37.7, v2.38.5, v2.39.3 and v2.40.1
- CVE
- CVE-2023-29007 · published
- GitHub Advisory Database
- Not reviewed
- OSV.dev
- Not present
- Other CVEs pointing here
- None found in the CVE List
If you use git <= v2.30.8, v2.31.7, v2.32.6, v2.33.7, v2.34.7, v2.35.7, v2.36.5, v2.37.6, v2.38.4, v2.39.2 and v2.40.0
The fixed-version field says “>= v2.30.9, v2.31.8, v2.32.7, v2.33.8, v2.34.8, v2.35.8, v2.36.6, v2.37.7, v2.38.5, v2.39.3 and v2.40.1”. Check the advisory for which version fixes it. Dependabot, npm audit and OSV-Scanner probably never will.
Timeline
2023-04-25 17:03 UTC
Published by the maintainers
Cites CVE-2023-29007
2026-10-31 12:45 UTC
First seen by Limbowatch
not reviewed · not in OSV
Not expected
Reviewed by GitHub
GitHub doesn’t review this ecosystem
Machine-readable record: feed/GHSA-v48j-4xgg-4844.json