Important: git security update
Summary
RLSA-2023:3246: Important: git security update. Affects git versions < 0:2.39.3-1.el8_8. Fixed in 0:2.39.3-1.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system with a decentralized architecture. It allows users to work on and contribute to projects without the need for permission to push changes to official repositories. Git also enables offline work. It is widely used in software development to manage source code and track changes.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Git:
-
CVE-2023-25652: By feeding specially crafted input to
git apply --reject, an attacker can overwrite a path outside the working tree with partially controlled contents. -
CVE-2023-29007: When renaming or deleting a section from a configuration file, arbitrary configuration injection is possible.
-
CVE-2023-22490: A maliciously crafted repository can lead to data exfiltration.
-
CVE-2023-23946: By using crafted input, an attacker can overwrite a path outside the working tree with git apply.
-
CVE-2023-25815: If git was compiled with a runtime prefix, an attacker can place crafted messages to achieve malicious outcomes.
These vulnerabilities can result in unauthorized access, data manipulation, and potential code execution.
How To Fix
Minimum fixed version
0:2.39.3-1.el8_8
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update as soon as possible.
Conclusion
This security update addresses multiple vulnerabilities in Git that can lead to unauthorized access, data manipulation, and potential code execution. It is crucial to update Git to the recommended version to mitigate these risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is a distributed version control system used for managing source code and tracking changes in software development projects.
These vulnerabilities can allow an attacker to overwrite files outside the working tree, inject arbitrary configuration, exfiltrate data, and achieve malicious outcomes.
To fix these vulnerabilities, update Git to version 2.39.3-1.el8_8 or later by using the package manager and verifying the updated version.
There are no known workarounds for these vulnerabilities. Applying the security update is the recommended solution.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
