VULNERABILITY INTELLIGENCE
CVE-2023-22743
Description
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
Weakness classification
- security-advisories@github.com: CWE-426
- nvd@nist.gov: CWE-426
Primary references
- security-advisories@github.com — Technical Description
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Vendor Advisory
- security-advisories@github.com — Vendor Advisory
- security-advisories@github.com — Patch, Technical Description, Vendor Advisory
- security-advisories@github.com — Patch, Technical Description, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Technical Description
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Technical Description, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Technical Description, Vendor Advisory