{"id":"ALPINE-CVE-2022-29187","details":"Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.","modified":"2026-11-12T01:31:40.886913041Z","published":"2022-07-12T21:15:09.560Z","upstream":["CVE-2022-29187"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2022-29187"}],"affected":[{"package":{"name":"git","ecosystem":"Alpine:v3.13","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.30.3"},{"fixed":"2.30.5-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.14","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.32.1"},{"fixed":"2.32.3-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.15","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.34.2"},{"fixed":"2.34.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.16","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.36.0"},{"fixed":"2.36.2-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.17","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.18","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.19","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.20","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"git","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/git?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.17","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.18","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.19","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.20","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}},{"package":{"name":"libgit2","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/libgit2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-29187.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}