x/vulndb: potential Go vuln in github.com/git-for-windows/git: CVE-2023-22743

[GoVulnBot]

CVE-2023-22743 references github.com/git-for-windows/git, which may be a Go module.

Description:
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-22743
• JSON: https://github.com/CVEProject/cvelist/tree/c97d185bc218cb03912de125f38b027c4b18ab86/2023/22xxx/CVE-2023-22743.json
• fix: GHSA-p2x9-prp4-8gvq
• web: GHSA-gf48-x3vr-j5c3
• web: https://attack.mitre.org/techniques/T1574/002/
• web: https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
• web: https://learn.microsoft.com/en-us/windows/win32/controls/cookbook-overview?redirectedfrom=MSDN#using-comctl32dll-version-6-in-an-application-that-uses-only-standard-extensions
• web: https://learn.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-
• Imported by: https://pkg.go.dev/github.com/git-for-windows/git?tab=importedby

Cross references:

• Module github.com/git-for-windows/git appears in issue x/vulndb: potential Go vuln in github.com/git-for-windows/git: CVE-2022-24765 #419 NOT_GO_CODE
• Module github.com/git-for-windows/git appears in issue x/vulndb: potential Go vuln in github.com/git-for-windows/git: CVE-2022-24767 #420 NOT_GO_CODE
• Module github.com/git-for-windows/git appears in issue x/vulndb: potential Go vuln in github.com/git-for-windows/git: CVE-2022-31012 #514 NOT_GO_CODE
• Module github.com/git-for-windows/git appears in issue x/vulndb: potential Go vuln in github.com/git-for-windows/git: CVE-2022-41953 #1498 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/git-for-windows/git
    packages:
      - package: git
description: |
    Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
cves:
  - CVE-2023-22743
references:
  - fix: https://github.com/git-for-windows/git/security/advisories/GHSA-p2x9-prp4-8gvq
  - web: https://github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3
  - web: https://attack.mitre.org/techniques/T1574/002/
  - web: https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
  - web: https://learn.microsoft.com/en-us/windows/win32/controls/cookbook-overview?redirectedfrom=MSDN#using-comctl32dll-version-6-in-an-application-that-uses-only-standard-extensions
  - web: https://learn.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-

[gopherbot]

Change https://go.dev/cl/468595 mentions this issue: data/excluded: batch add GO-2023-1565, GO-2023-1564, GO-2023-1563, GO-2023-1562