Skip to content
OpenAdvisories
Critical RHSA-2023:0609 2 CVEs

Red Hat Security Advisory: git security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 57

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-all 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-core 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-core-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-core-doc 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-daemon 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-daemon-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-debugsource 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-email 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-gui 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-instaweb 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-subtree 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-svn 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream git-svn-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream gitk 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream gitweb 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream perl-Git 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream perl-Git-SVN 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-all 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-core 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-core-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-core-doc 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-daemon 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-daemon-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-debugsource 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-email 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-gui 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-instaweb 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-subtree 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-svn 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream git-svn-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream gitk 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream gitweb 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream perl-Git 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream perl-Git-SVN 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-all 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-core 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-core-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-core-doc 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-daemon 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-daemon-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-debugsource 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-email 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-gui 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-instaweb 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-subtree 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-svn 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream git-svn-debuginfo 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream gitk 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream gitweb 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream perl-Git 0:2.18.4-3.el8_2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream perl-Git-SVN 0:2.18.4-3.el8_2

Vulnerabilities 2

  • Critical 9.8
    CVE-2022-23521 EPSS 56%

    gitattributes parsing integer overflow in git

    Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes tha…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2022-41903 Public exploit EPSS 44%

    Integer overflow in `git archive`, `git log --format` leading to RCE in git

    Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, t…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2162055
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2162056
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0609.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-23521
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23521
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23521
  • article
    https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/
  • article
    https://github.com/git/git/files/10430260/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf
  • article
    https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89
  • article
    https://www.openwall.com/lists/oss-security/2023/01/17/4
  • report
    https://access.redhat.com/security/cve/CVE-2022-41903
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-41903
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-41903
  • article
    https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq