CVE-2023-25815

CVE Details

Release Date:	2023-04-25
Impact:	None	What is this?

Description

In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the gettext() function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path C:\mingw64\share\locale to look for localized messages. And since any authenticated user has the permission to create folders in C:\ (and since C:\mingw64 does not typically exist), it is possible for low-privilege users to place fake messages in that location where git.exe will pick them up in version 2.40.1.

See more information about CVE-2023-25815 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	2.2
Vector String:	CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Version:	3.0
Attack Vector:	Local
Attack Complexity:	High
Privileges Required:	Low
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	Low
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (git)	ELSA-2023-3246	2023-05-24
Oracle Linux version 9 (git)	ELSA-2023-3245	2023-05-23