Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:1484-1

Опубликовано: 02 мая 2022
Источник: suse-cvrf

Описание

Security update for git

This update for git fixes the following issues:

  • Updated to version 2.35.3:
    • CVE-2022-24765: Fixed a potential command injection via git worktree (bsc#1198234).

Список пакетов

Container bci/golang:1.16
git-core-2.35.3-150300.10.12.1
Container bci/golang:1.17
git-core-2.35.3-150300.10.12.1
Container bci/golang:1.18
git-core-2.35.3-150300.10.12.1
Container bci/golang:1.19
git-core-2.35.3-150300.10.12.1
Container bci/golang:1.20-openssl
git-core-2.35.3-150300.10.12.1
Container bci/golang:1.21
git-core-2.35.3-150300.10.12.1
Container bci/golang:latest
git-core-2.35.3-150300.10.12.1
Container bci/node:12
git-core-2.35.3-150300.10.12.1
Container bci/node:14
git-core-2.35.3-150300.10.12.1
Container bci/node:16
git-core-2.35.3-150300.10.12.1
Container bci/node:18
git-core-2.35.3-150300.10.12.1
Container bci/nodejs:latest
git-core-2.35.3-150300.10.12.1
Container bci/openjdk-devel:11
git-core-2.35.3-150300.10.12.1
Container bci/openjdk-devel:latest
git-core-2.35.3-150300.10.12.1
Container bci/openjdk:11
git-core-2.35.3-150300.10.12.1
Container bci/openjdk:17
git-core-2.35.3-150300.10.12.1
Container bci/python:3
git-core-2.35.3-150300.10.12.1
Container bci/python:latest
git-core-2.35.3-150300.10.12.1
Container bci/ruby:latest
git-core-2.35.3-150300.10.12.1
Container suse/git:latest
git-core-2.35.3-150300.10.12.1
SUSE Linux Enterprise Module for Basesystem 15 SP3
git-core-2.35.3-150300.10.12.1
perl-Git-2.35.3-150300.10.12.1
SUSE Linux Enterprise Module for Development Tools 15 SP3
git-2.35.3-150300.10.12.1
git-arch-2.35.3-150300.10.12.1
git-cvs-2.35.3-150300.10.12.1
git-daemon-2.35.3-150300.10.12.1
git-doc-2.35.3-150300.10.12.1
git-email-2.35.3-150300.10.12.1
git-gui-2.35.3-150300.10.12.1
git-svn-2.35.3-150300.10.12.1
git-web-2.35.3-150300.10.12.1
gitk-2.35.3-150300.10.12.1
openSUSE Leap 15.3
git-2.35.3-150300.10.12.1
git-arch-2.35.3-150300.10.12.1
git-core-2.35.3-150300.10.12.1
git-credential-gnome-keyring-2.35.3-150300.10.12.1
git-credential-libsecret-2.35.3-150300.10.12.1
git-cvs-2.35.3-150300.10.12.1
git-daemon-2.35.3-150300.10.12.1
git-doc-2.35.3-150300.10.12.1
git-email-2.35.3-150300.10.12.1
git-gui-2.35.3-150300.10.12.1
git-p4-2.35.3-150300.10.12.1
git-svn-2.35.3-150300.10.12.1
git-web-2.35.3-150300.10.12.1
gitk-2.35.3-150300.10.12.1
perl-Git-2.35.3-150300.10.12.1
openSUSE Leap 15.4
git-2.35.3-150300.10.12.1
git-arch-2.35.3-150300.10.12.1
git-core-2.35.3-150300.10.12.1
git-credential-gnome-keyring-2.35.3-150300.10.12.1
git-credential-libsecret-2.35.3-150300.10.12.1
git-cvs-2.35.3-150300.10.12.1
git-daemon-2.35.3-150300.10.12.1
git-doc-2.35.3-150300.10.12.1
git-email-2.35.3-150300.10.12.1
git-gui-2.35.3-150300.10.12.1
git-p4-2.35.3-150300.10.12.1
git-svn-2.35.3-150300.10.12.1
git-web-2.35.3-150300.10.12.1
gitk-2.35.3-150300.10.12.1
perl-Git-2.35.3-150300.10.12.1

Ссылки

Описание

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.

Затронутые продукты
Container bci/golang:1.16:git-core-2.35.3-150300.10.12.1
Container bci/golang:1.17:git-core-2.35.3-150300.10.12.1
Container bci/golang:1.18:git-core-2.35.3-150300.10.12.1
Container bci/golang:1.19:git-core-2.35.3-150300.10.12.1
Ссылки
Уязвимость SUSE-SU-2022:1484-1