5.5

CVE-2022-39253: apple xcode

CVSS: 5.5v3.1MediumModified
AliasesALPINE-CVE-2022-39253UBUNTU-CVE-2022-39253USN-5686-4
Published 19-10-2022Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2022-39253 is a medium (CVSS 5.5) vulnerability in apple xcode. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.5% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.48%
0%100%
Low · +0.20 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 7
DLA-3239-1DSA-5332-1MGASA-2022-0396OPENSUSE-SU-2024:12487-1RHSA-2023:2319RHSA-2023:2859

Timeline

  1. 19-10-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.48%

Chance of exploitation in the next 30 days

Percentile

74%

Versus all other CVEs

30-day change

+0.20 pp

From 1.28% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Opensuse3 products
  • docker-compose&distro=openSUSE Tumbleweed< 2.12.2-1.1
  • perl-Git-Repository&distro=openSUSE Tumbleweed< 1.326.0-1.1
  • reuse&distro=openSUSE Tumbleweed< 1.1.2-1.1
Debian2 products
Alpine1 product
  • git≥ 2.31.0, < 2.30.6-r0 | ≥ 2.31.0, < 2.32.4-r0 | ≥ 2.31.0, < 2.34.5-r0 | ≥ 2.31.0, < 2.36.3-r0 | ≥ 2.31.0, < 2.38.1-r0
Apple1 product
Chainguard1 product
  • git< 2.38.1-r0
Fedoraproject1 product
Git1 product
  • git< 2.30.6 | < 2.31.5 | < 2.32.4 | < 2.33.5 | < 2.34.5 | < 2.35.5 | < 2.36.3 | < 2.37.4
Git-scm1 product
  • git< 2.30.6 | ≥ 2.31.0, < 2.31.5 | ≥ 2.32.0, < 2.32.4 | ≥ 2.33.0, < 2.33.5 | ≥ 2.34.0, < 2.34.5 | ≥ 2.35.0, < 2.35.5 | ≥ 2.36.0, < 2.36.3 | ≥ 2.37.0, < 2.37.4 | 2.38.0
Ubuntu1 product
  • git< 1:2.17.1-1ubuntu0.13 | < 1:2.25.1-1ubuntu3.6 | < 1:2.34.1-1ubuntu1.5 | < 1:2.7.4-0ubuntu1.10+esm6
Wolfi1 product
  • git< 2.38.1-r0

10 vendors · 13 products

References

22 links
Show all 22 references