Skip to content
OpenAdvisories
High ELSA-2023-3263 2 CVEs

Important: git security update (Oracle Linux 7)

Published May 23, 2023 · Updated May 23, 2023

Ecosystem: Oracle Linux

Summary

[1.8.3.1-25]
- Fixes CVE-2023-25652 and CVE-2023-29007
- Resolves: #2188354, #2188365

Fixed packages 18

ReleasePackageFixed in
Oracle Linux · 7 emacs-git 0:1.8.3.1-25.el7_9
Oracle Linux · 7 emacs-git-el 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-all 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-bzr 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-cvs 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-daemon 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-email 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-gnome-keyring 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-gui 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-hg 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-instaweb 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-p4 0:1.8.3.1-25.el7_9
Oracle Linux · 7 git-svn 0:1.8.3.1-25.el7_9
Oracle Linux · 7 gitk 0:1.8.3.1-25.el7_9
Oracle Linux · 7 gitweb 0:1.8.3.1-25.el7_9
Oracle Linux · 7 perl-Git 0:1.8.3.1-25.el7_9
Oracle Linux · 7 perl-Git-SVN 0:1.8.3.1-25.el7_9

Vulnerabilities 2

  • High 7.5
    CVE-2023-25652 EPSS 52%

    "git apply --reject" partially-controlled arbitrary file write

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…

    git git git git Debian Ubuntu Alpine Wolfi
  • High 7.0
    CVE-2023-29007 Public exploit

    Arbitrary configuration injection via `git submodule deinit`

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…

    git git git git Debian Ubuntu Alpine Wolfi