Important: git security update
Summary
ALSA-2023:0611: Important: git security update. Affects git versions < 2.31.1-3.el9_1. Fixed in 2.31.1-3.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system with a decentralized architecture. It allows users to work on and contribute to projects without the need for permission to push changes to official repositories. Git also enables offline work. It is widely used for version control and collaboration in software development.
Vulnerability Detail
The vulnerability in Git is related to two security issues:
-
CVE-2022-23521: Gitattributes parsing integer overflow This vulnerability can lead to a heap overflow and potentially allow remote code execution.
-
CVE-2022-41903: Heap overflow in
git archive,git log --formatThis vulnerability can also lead to a heap overflow and potentially allow remote code execution.
These vulnerabilities can be exploited by an attacker to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
2.31.1-3.el9_1
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to mitigate the risk.
Conclusion
It is crucial to update Git to the latest version to protect against these vulnerabilities. Failure to do so may expose your system to potential remote code execution or denial of service attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is a distributed version control system used for tracking changes in files and coordinating work on those files among multiple people.
These vulnerabilities can potentially allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Git installation is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground and it will alert you if any vulnerabilities are found.
There are no known workarounds for these vulnerabilities. It is recommended to update Git to the latest version.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for git.
