Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-02-14T20:39:30.094Z

Updated: 2024-08-02T10:20:30.039Z

Reserved: 2023-01-06T14:21:05.892Z

Link: CVE-2023-22743

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-02-14T21:15:12.547

Modified: 2024-11-21T07:45:20.403

Link: CVE-2023-22743

cve-icon Redhat

No data.