What is CVE-2022-41903?

CVE-2022-41903 is a critical vulnerability in the Git distributed revision control system, affecting the 'git log' and 'git archive' commands. With a severity score of 9.8, this integer overflow vulnerability can result in arbitrary heap writes, potentially leading to arbitrary code execution.

Who is impacted by this?

The impacted versions include Git up to and including 2.30.6, and versions 2.31.0 to 2.39.0. Users of these versions are at risk and should consider upgrading to a patched version.

What should I do if I’m affected?

If you're affected by CVE-2022-41903, follow these steps to protect your system:

1. Check if you're using an affected version of Git.

2. Upgrade to a patched version to fix the vulnerability.

3. Stay informed about new vulnerabilities and apply updates promptly.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-41903 vulnerability, also known as Integer Overflow or Wraparound in Git, is not listed in CISA's Known Exploited Vulnerabilities Catalog

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-190, which is an integer overflow or wraparound issue in Git.

Learn More

For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• NVD - CVE-2022-41903

• Git - Git Attributes

• Git - pretty-formats Documentation

• GitHub Commit - Sync with 2.39.1