Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:0430-1

Опубликовано: 15 фев. 2023
Источник: suse-cvrf

Описание

Security update for git

This update for git fixes the following issues:

  • CVE-2023-22490: Fixed incorrectly usable local clone optimization even when using a non-local transport (bsc#1208027).
  • CVE-2023-23946: Fixed issue where a path outside the working tree can be overwritten as the user who is running 'git apply' (bsc#1208028).

Список пакетов

Container bci/golang:1.18
git-core-2.35.3-150300.10.24.1
Container bci/golang:1.19
git-core-2.35.3-150300.10.24.1
Container bci/golang:1.20-openssl
git-core-2.35.3-150300.10.24.1
Container bci/golang:1.21
git-core-2.35.3-150300.10.24.1
Container bci/golang:latest
git-core-2.35.3-150300.10.24.1
Container bci/node:14
git-core-2.35.3-150300.10.24.1
Container bci/node:16
git-core-2.35.3-150300.10.24.1
Container bci/node:18
git-core-2.35.3-150300.10.24.1
Container bci/nodejs:latest
git-core-2.35.3-150300.10.24.1
Container bci/openjdk-devel:11
git-core-2.35.3-150300.10.24.1
Container bci/openjdk-devel:latest
git-core-2.35.3-150300.10.24.1
Container bci/openjdk:11
git-core-2.35.3-150300.10.24.1
Container bci/openjdk:17
git-core-2.35.3-150300.10.24.1
Container bci/python:3
git-core-2.35.3-150300.10.24.1
Container bci/python:latest
git-core-2.35.3-150300.10.24.1
Container bci/ruby:latest
git-core-2.35.3-150300.10.24.1
Container suse/git:latest
git-core-2.35.3-150300.10.24.1
SUSE Enterprise Storage 7.1
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Linux Enterprise Module for Basesystem 15 SP4
git-core-2.35.3-150300.10.24.1
SUSE Linux Enterprise Module for Development Tools 15 SP4
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Linux Enterprise Real Time 15 SP3
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Linux Enterprise Server 15 SP3-LTSS
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Manager Proxy 4.2
git-core-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Manager Retail Branch Server 4.2
git-core-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
SUSE Manager Server 4.2
git-core-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1
openSUSE Leap 15.4
git-2.35.3-150300.10.24.1
git-arch-2.35.3-150300.10.24.1
git-core-2.35.3-150300.10.24.1
git-credential-gnome-keyring-2.35.3-150300.10.24.1
git-credential-libsecret-2.35.3-150300.10.24.1
git-cvs-2.35.3-150300.10.24.1
git-daemon-2.35.3-150300.10.24.1
git-doc-2.35.3-150300.10.24.1
git-email-2.35.3-150300.10.24.1
git-gui-2.35.3-150300.10.24.1
git-p4-2.35.3-150300.10.24.1
git-svn-2.35.3-150300.10.24.1
git-web-2.35.3-150300.10.24.1
gitk-2.35.3-150300.10.24.1
perl-Git-2.35.3-150300.10.24.1

Ссылки

Описание

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.

Затронутые продукты
Container bci/golang:1.18:git-core-2.35.3-150300.10.24.1
Container bci/golang:1.19:git-core-2.35.3-150300.10.24.1
Container bci/golang:1.20-openssl:git-core-2.35.3-150300.10.24.1
Container bci/golang:1.21:git-core-2.35.3-150300.10.24.1
Ссылки

Описание

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

Затронутые продукты
Container bci/golang:1.18:git-core-2.35.3-150300.10.24.1
Container bci/golang:1.19:git-core-2.35.3-150300.10.24.1
Container bci/golang:1.20-openssl:git-core-2.35.3-150300.10.24.1
Container bci/golang:1.21:git-core-2.35.3-150300.10.24.1
Ссылки
Уязвимость SUSE-SU-2023:0430-1