Answer in brief
CVE-2023-29007 records a High severity (CVSS 7.0) vulnerability in Arbitrary configuration injection via `git submodule deinit`. The current sources do not mark it as known exploited. The current feed maps git/git (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps git/git (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:git-scm:git:2.40.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| git/gitgeneric | <2.30.9 || >=2.31.0 <2.31.8 || >=2.32.0 <2.32.7 || >=2.33.0 <2.33.8 || >=2.34.0 <2.34.8 || >=2.35.0 <2.35.8 || >=2.36.0 <2.36.6 || >=2.37.0 <2.37.7 || >=2.38.0 <2.38.5 || >=2.39.0 <2.39.3 || >=2.40.0 <2.40.1 | 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, 2.40.1 |
Published upstream
Apr 25, 2023
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 2, 2026
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
Quoted source text, attributed separately from HOL analysis.