Important: git security update
Summary
ALSA-2023:3245: Important: git security update. Affects git versions < 2.39.3-1.el9_2. Fixed in 2.39.3-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system with a decentralized architecture. It allows users to work on and contribute to projects without the need for permission to push changes to official repositories. Git also enables offline work. It is widely used in software development for version control and collaboration.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Git:
- CVE-2023-25652: By feeding specially crafted input to
git apply --reject, an attacker can overwrite a path outside the working tree with partially controlled contents. - CVE-2023-29007: When renaming or deleting a section from a configuration file, arbitrary configuration injection can occur.
- CVE-2023-22490: A maliciously crafted repository can lead to data exfiltration.
- CVE-2023-23946: By using crafted input, an attacker can overwrite a path outside the working tree with
git apply. - CVE-2023-25815: If Git was compiled with a runtime prefix, malicious placement of crafted messages is possible.
These vulnerabilities can result in unauthorized access, data manipulation, and potential code execution.
How To Fix
Minimum fixed version
2.39.3-1.el9_2
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating Git to the latest version is crucial to address these vulnerabilities. It is recommended to follow the provided steps and ensure that the updated version is installed correctly. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is a distributed revision control system used for version control and collaboration in software development.
These vulnerabilities can lead to unauthorized access, data manipulation, and potential code execution.
You can use the Vulert Playground at Vulert Scanner to check if your Git installation is affected by these vulnerabilities.
No, updating Git to the latest version is the recommended solution.
You can refer to the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for git.
