CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit`
Attackers can inject arbitrary configuration into Git settings via crafted submodule URLs, leading to remote code execution when specific commands are run.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29007?
CVE-2023-29007 is a high-severity code injection vulnerability in Fedoraproject Fedora, published on 25 Apr 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
Weakness: CWE-74
Which versions are affected by CVE-2023-29007?
It affects 2 products.
Products include Fedoraproject Fedora, Git-Scm Git.
How do I fix CVE-2023-29007?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-29007 being exploited?
There is no known exploitation of CVE-2023-29007 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-29007, CLEANSTART-2026-BE00083, DEBIAN-CVE-2023-29007, GHSA-v48j-4xgg-4844, UBUNTU-CVE-2023-29007.