Skip to content
OpenAdvisories
High ELSA-2023-3246 5 CVEs

Important: git security update (Oracle Linux 8)

Published May 24, 2023 · Updated May 24, 2023

Ecosystem: Oracle Linux

Summary

[2.39.3-1]
- Update to 2.39.3
- Resolves: #2188364, #2188373, #2190157, #2190158

Fixed packages 15

ReleasePackageFixed in
Oracle Linux · 8 git 0:2.39.3-1.el8_8
Oracle Linux · 8 git-all 0:2.39.3-1.el8_8
Oracle Linux · 8 git-core 0:2.39.3-1.el8_8
Oracle Linux · 8 git-core-doc 0:2.39.3-1.el8_8
Oracle Linux · 8 git-credential-libsecret 0:2.39.3-1.el8_8
Oracle Linux · 8 git-daemon 0:2.39.3-1.el8_8
Oracle Linux · 8 git-email 0:2.39.3-1.el8_8
Oracle Linux · 8 git-gui 0:2.39.3-1.el8_8
Oracle Linux · 8 git-instaweb 0:2.39.3-1.el8_8
Oracle Linux · 8 git-subtree 0:2.39.3-1.el8_8
Oracle Linux · 8 git-svn 0:2.39.3-1.el8_8
Oracle Linux · 8 gitk 0:2.39.3-1.el8_8
Oracle Linux · 8 gitweb 0:2.39.3-1.el8_8
Oracle Linux · 8 perl-Git 0:2.39.3-1.el8_8
Oracle Linux · 8 perl-Git-SVN 0:2.39.3-1.el8_8

Vulnerabilities 5

  • High 7.5
    CVE-2023-25652 EPSS 52%

    "git apply --reject" partially-controlled arbitrary file write

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…

    git git git git Debian Ubuntu Alpine Wolfi
  • High 7.0
    CVE-2023-29007 Public exploit

    Arbitrary configuration injection via `git submodule deinit`

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…

    git git git git Debian Ubuntu Alpine Wolfi
  • Medium 6.2
    CVE-2023-23946 Public exploit

    Git's `git apply` overwriting paths outside the working tree

    Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten…

    git git git git Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2023-22490 Public exploit

    Git vulnerable to local clone-based data exfiltration with non-local transports

    Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local…

    git git git git Debian Ubuntu Alpine Wolfi
  • Low 3.3
    CVE-2023-25815

    Git looks for localized messages in the wrong place

    In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…

    git-for-windows git git git Debian Ubuntu Alpine