Action not permitted
Modal body text goes here.
cve-2022-39253
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T12:00:43.267Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85" }, { "name": "FEDORA-2022-12790ca71a", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/" }, { "name": "FEDORA-2022-8b58806840", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213496" }, { "name": "FEDORA-2022-53aadd995f", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/" }, { "name": "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1", "tags": [ "mailing-list", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2022/Nov/1" }, { "name": "FEDORA-2022-2c33bba286", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/" }, { "name": "FEDORA-2022-fb088df94c", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/" }, { "name": "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "name": "[oss-security] 20230214 [Announce] Git 2.39.2 and friends", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/02/14/5" }, { "name": "GLSA-202312-15", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202312-15" }, { "name": "[oss-security] 20240514 git: 5 vulnerabilities fixed", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/05/14/2" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "git", "vendor": "git", "versions": [ { "status": "affected", "version": "\u003c 2.30.6" }, { "status": "affected", "version": "\u003c 2.31.5" }, { "status": "affected", "version": "\u003c 2.32.4" }, { "status": "affected", "version": "\u003c 2.33.5" }, { "status": "affected", "version": "\u003c 2.34.5" }, { "status": "affected", "version": "\u003c 2.35.5" }, { "status": "affected", "version": "\u003c 2.36.3" }, { "status": "affected", "version": "\u003c 2.37.4" } ] } ], "descriptions": [ { "lang": "en", "value": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-10T17:14:58.362681", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "url": "https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85" }, { "name": "FEDORA-2022-12790ca71a", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/" }, { "name": "FEDORA-2022-8b58806840", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/" }, { "url": "https://support.apple.com/kb/HT213496" }, { "name": "FEDORA-2022-53aadd995f", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/" }, { "name": "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1", "tags": [ "mailing-list" ], "url": "http://seclists.org/fulldisclosure/2022/Nov/1" }, { "name": "FEDORA-2022-2c33bba286", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/" }, { "name": "FEDORA-2022-fb088df94c", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/" }, { "name": "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "name": "[oss-security] 20230214 [Announce] Git 2.39.2 and friends", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2023/02/14/5" }, { "name": "GLSA-202312-15", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202312-15" }, { "name": "[oss-security] 20240514 git: 5 vulnerabilities fixed", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2024/05/14/2" } ], "source": { "advisory": "GHSA-3wp6-j8xr-qw85", "discovery": "UNKNOWN" }, "title": "Git subject to exposure of sensitive information via local clone of symbolic links" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-39253", "datePublished": "2022-10-19T00:00:00", "dateReserved": "2022-09-02T00:00:00", "dateUpdated": "2024-08-03T12:00:43.267Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-39253\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-10-19T11:15:11.227\",\"lastModified\":\"2024-06-10T18:15:19.643\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.\"},{\"lang\":\"es\",\"value\":\"Git es un sistema de control de revisiones distribuido, escalable y de c\u00f3digo abierto. Las versiones anteriores a la 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 est\u00e1n sujetas a una exposici\u00f3n de informaci\u00f3n confidencial a un actor malicioso. Cuando es llevado a cabo un clon local (en el que el origen y el destino del clon est\u00e1n en el mismo volumen), Git copia el contenido del directorio \\\"$GIT_DIR/objects\\\" del origen en el destino creando enlaces duros al contenido del origen o copi\u00e1ndolo (si los enlaces duros est\u00e1n deshabilitados por medio de \\\"--no-hardlinks\\\"). Un actor malicioso podr\u00eda convencer a una v\u00edctima de clonar un repositorio con un enlace simb\u00f3lico que apunte a informaci\u00f3n confidencial en la m\u00e1quina de la v\u00edctima. Esto puede hacerse ya sea que la v\u00edctima clone un repositorio malicioso en la misma m\u00e1quina, o haciendo que clone un repositorio malicioso insertado como repositorio desnudo por medio de un subm\u00f3dulo de cualquier fuente, siempre que clone con la opci\u00f3n \\\"--recurse-submodules\\\". Git no crea enlaces simb\u00f3licos en el directorio \\\"$GIT_DIR/objects\\\". El problema ha sido parcheado en las versiones publicadas el 18-10-2022, y retrocedido a v2.30.x. Posibles mitigaciones: Evite clonar repositorios no confiables usando la optimizaci\u00f3n \\\"--local\\\" cuando est\u00e9 en una m\u00e1quina compartida, ya sea pasando la opci\u00f3n \\\"--no-local\\\" a \\\"git clone\\\" o clonando desde una URL que use el esquema \\\"file://\\\". Alternativamente, evita clonar repositorios de fuentes no confiables con \\\"--recurse-submodules\\\" o ejecuta \\\"git config --global protocol.file.allow user\\\"\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.30.6\",\"matchCriteriaId\":\"28199E8F-36D0-46F8-AF0A-9460390BE56F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.31.0\",\"versionEndExcluding\":\"2.31.5\",\"matchCriteriaId\":\"E095AAE7-18C2-4957-9740-FC804860B9C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.32.0\",\"versionEndExcluding\":\"2.32.4\",\"matchCriteriaId\":\"459EE43E-40FB-45BE-A1CC-51435E9F92AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.33.0\",\"versionEndExcluding\":\"2.33.5\",\"matchCriteriaId\":\"2CBDDA42-F5EC-4747-BF3C-16683D684702\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.34.0\",\"versionEndExcluding\":\"2.34.5\",\"matchCriteriaId\":\"D7691E22-145E-4D97-A6E0-6515742781B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.35.0\",\"versionEndExcluding\":\"2.35.5\",\"matchCriteriaId\":\"E02396C2-BB34-4D18-917E-DA56EA7B58B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.36.0\",\"versionEndExcluding\":\"2.36.3\",\"matchCriteriaId\":\"51BEAEEC-9D9D-4CFE-8958-43BFE87DE501\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.37.0\",\"versionEndExcluding\":\"2.37.4\",\"matchCriteriaId\":\"566CF89C-AC39-47D7-B3DE-633B2237F816\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AFEECCB-B8DB-4270-A860-C2BA1C7B267C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\",\"matchCriteriaId\":\"CECD39AA-41F4-4638-B59A-C5E928B585C3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2022/Nov/1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/02/14/5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/14/2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://security.gentoo.org/glsa/202312-15\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://support.apple.com/kb/HT213496\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
var-202210-1202
Vulnerability from variot
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's $GIT_DIR/objects
directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via --no-hardlinks
). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the --recurse-submodules
option. Git does not create symbolic links in the $GIT_DIR/objects
directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the --local
optimization when on a shared machine, either by passing the --no-local
option to git clone
or cloning from a URL that uses the file://
scheme. Alternatively, avoid cloning repositories from untrusted sources with --recurse-submodules
or run git config --global protocol.file.allow user
. Git SCM of Git Products from several other vendors contain link interpretation vulnerabilities.Information may be obtained. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: git security and bug fix update Advisory ID: RHSA-2023:2319-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:2319 Issue date: 2023-05-09 CVE Names: CVE-2022-24765 CVE-2022-29187 CVE-2022-39253 CVE-2022-39260 ==================================================================== 1. Summary:
An update for git is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64
- As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
-
git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
-
git: Bypass of safe.directory protections (CVE-2022-29187)
-
git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
-
git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2073414 - CVE-2022-24765 git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree 2107439 - CVE-2022-29187 git: Bypass of safe.directory protections 2137422 - CVE-2022-39253 git: exposure of sensitive information to a malicious actor 2137423 - CVE-2022-39260 git: git shell function that splits command arguments can lead to arbitrary heap writes. 2139379 - Rebase git to 2.39 version [rhel-9.2]
- Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source: git-2.39.1-1.el9.src.rpm
aarch64: git-2.39.1-1.el9.aarch64.rpm git-core-2.39.1-1.el9.aarch64.rpm git-core-debuginfo-2.39.1-1.el9.aarch64.rpm git-credential-libsecret-2.39.1-1.el9.aarch64.rpm git-credential-libsecret-debuginfo-2.39.1-1.el9.aarch64.rpm git-daemon-2.39.1-1.el9.aarch64.rpm git-daemon-debuginfo-2.39.1-1.el9.aarch64.rpm git-debuginfo-2.39.1-1.el9.aarch64.rpm git-debugsource-2.39.1-1.el9.aarch64.rpm git-subtree-2.39.1-1.el9.aarch64.rpm
noarch: git-all-2.39.1-1.el9.noarch.rpm git-core-doc-2.39.1-1.el9.noarch.rpm git-email-2.39.1-1.el9.noarch.rpm git-gui-2.39.1-1.el9.noarch.rpm git-instaweb-2.39.1-1.el9.noarch.rpm git-svn-2.39.1-1.el9.noarch.rpm gitk-2.39.1-1.el9.noarch.rpm gitweb-2.39.1-1.el9.noarch.rpm perl-Git-2.39.1-1.el9.noarch.rpm perl-Git-SVN-2.39.1-1.el9.noarch.rpm
ppc64le: git-2.39.1-1.el9.ppc64le.rpm git-core-2.39.1-1.el9.ppc64le.rpm git-core-debuginfo-2.39.1-1.el9.ppc64le.rpm git-credential-libsecret-2.39.1-1.el9.ppc64le.rpm git-credential-libsecret-debuginfo-2.39.1-1.el9.ppc64le.rpm git-daemon-2.39.1-1.el9.ppc64le.rpm git-daemon-debuginfo-2.39.1-1.el9.ppc64le.rpm git-debuginfo-2.39.1-1.el9.ppc64le.rpm git-debugsource-2.39.1-1.el9.ppc64le.rpm git-subtree-2.39.1-1.el9.ppc64le.rpm
s390x: git-2.39.1-1.el9.s390x.rpm git-core-2.39.1-1.el9.s390x.rpm git-core-debuginfo-2.39.1-1.el9.s390x.rpm git-credential-libsecret-2.39.1-1.el9.s390x.rpm git-credential-libsecret-debuginfo-2.39.1-1.el9.s390x.rpm git-daemon-2.39.1-1.el9.s390x.rpm git-daemon-debuginfo-2.39.1-1.el9.s390x.rpm git-debuginfo-2.39.1-1.el9.s390x.rpm git-debugsource-2.39.1-1.el9.s390x.rpm git-subtree-2.39.1-1.el9.s390x.rpm
x86_64: git-2.39.1-1.el9.x86_64.rpm git-core-2.39.1-1.el9.x86_64.rpm git-core-debuginfo-2.39.1-1.el9.x86_64.rpm git-credential-libsecret-2.39.1-1.el9.x86_64.rpm git-credential-libsecret-debuginfo-2.39.1-1.el9.x86_64.rpm git-daemon-2.39.1-1.el9.x86_64.rpm git-daemon-debuginfo-2.39.1-1.el9.x86_64.rpm git-debuginfo-2.39.1-1.el9.x86_64.rpm git-debugsource-2.39.1-1.el9.x86_64.rpm git-subtree-2.39.1-1.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-24765 https://access.redhat.com/security/cve/CVE-2022-29187 https://access.redhat.com/security/cve/CVE-2022-39253 https://access.redhat.com/security/cve/CVE-2022-39260 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBZFo03tzjgjWX9erEAQhYSg//bKkon2hHN6jSsXXntqw9ViT5zo9r/KTD cV+t7GM4ipVK8j4EW8EnQKrJBWAzsEhqM2vh9MvM/PpTQ2I/JP53YbTed0qgxE3T SU07XMVbh1BA7OKyJ+eKfWJLBT03/VzzaepqQPwyHyFDAegJ/L9DlZOkHc9NJrfa R+N2Hde/TmUlnRl737ltWtQHE1QSTV1PQZuXb3AEWm6FDe7O62F0GpsuIWj1z8oo IIDLHRjp/mCqT6/A70NIRQvcwhLfRYYMOezKL80iGi7WwRokwEScDFE+gzB9FLrf pjNBFZkQVVxMVYOejArmPuLINaEdZJo/HAOiEtw9gOTzALyKFbWwOHDmSzz1hgbz kqFtZgwnpVZNs3UubXCgWeP4aU9xueZeyBHKNQKVERODtrKFt5jbpPrXu6qGyP9O 6GSgMbUDO5OMqOhTKQiMbKj5gO2DfOIO6vNP5eFwvSXPJG0ZlPIzAJD1cwZdtsVK wWBIMfjjc8zUh8OYm+CWg/lgpZLkQxe/wtFcC7Pw1u7nkN95npMXM3O75R8xe1zg xsa+wzjCmVRwrO2gLnT7/NUkY3saShCvBD+A82trnasbVlI/49oiojZY1PI3CZtz afQDlfLvgygNkV3e5CGe5p9PILwmFbrpALV43dEz6eY+MbeuoE6I7ON8tYtmx4Ds hOpSLJjOLjE=YQQZ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2022-11-01-1 Xcode 14.1
Xcode 14.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213496.
Git Available for: macOS Monterey 12.5 and later Impact: Multiple issues in git Description: Multiple issues were addressed by updating to git version 2.32.3. CVE-2022-29187: Carlo Marcelo Arenas Belón and Johannes Schindelin
Git Available for: macOS Monterey 12.5 and later Impact: Cloning a malicious repository may result in the disclosure of sensitive information Description: This issue was addressed with improved checks. CVE-2022-39253: Cory Snider of Mirantis
Git Available for: macOS Monterey 12.5 and later Impact: A remote user may cause an unexpected app termination or arbitrary code execution if git shell is allowed as a login shell Description: This issue was addressed with improved checks. CVE-2022-39260: Kevin Backhouse of the GitHub Security Lab
IDE Xcode Server Available for: macOS Monterey 12.5 and later Impact: An app may be able to gain root privileges Description: An injection issue was addressed with improved input validation. CVE-2022-42797: Tim Michaud (@TimGMichaud) of Moveworks.ai
Xcode 14.1 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "Xcode 14.1". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222.
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. ========================================================================== Ubuntu Security Notice USN-5686-3 November 21, 2022
git vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
Summary:
Several security issues were fixed in Git. This update provides the corresponding updates for Ubuntu 22.10.
Original advisory details:
Cory Snider discovered that Git incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause an unexpected behaviour. (CVE-2022-39253)
Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could possibly use this issue to arbitrary code execution. (CVE-2022-39260)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.10: git 1:2.37.2-1ubuntu1.1
In general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202312-15
https://security.gentoo.org/
Severity: High Title: Git: Multiple Vulnerabilities Date: December 27, 2023 Bugs: #838127, #857831, #877565, #891221, #894472, #905088 ID: 202312-15
Synopsis
Several vulnerabilities have been found in Git, the worst of which could lead to remote code execution.
Affected packages
Package Vulnerable Unaffected
dev-vcs/git < 2.39.3 >= 2.39.3
Description
Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.39.3"
References
[ 1 ] CVE-2022-23521 https://nvd.nist.gov/vuln/detail/CVE-2022-23521 [ 2 ] CVE-2022-24765 https://nvd.nist.gov/vuln/detail/CVE-2022-24765 [ 3 ] CVE-2022-29187 https://nvd.nist.gov/vuln/detail/CVE-2022-29187 [ 4 ] CVE-2022-39253 https://nvd.nist.gov/vuln/detail/CVE-2022-39253 [ 5 ] CVE-2022-39260 https://nvd.nist.gov/vuln/detail/CVE-2022-39260 [ 6 ] CVE-2022-41903 https://nvd.nist.gov/vuln/detail/CVE-2022-41903 [ 7 ] CVE-2023-22490 https://nvd.nist.gov/vuln/detail/CVE-2023-22490 [ 8 ] CVE-2023-23946 https://nvd.nist.gov/vuln/detail/CVE-2023-23946 [ 9 ] CVE-2023-25652 https://nvd.nist.gov/vuln/detail/CVE-2023-25652 [ 10 ] CVE-2023-25815 https://nvd.nist.gov/vuln/detail/CVE-2023-25815 [ 11 ] CVE-2023-29007 https://nvd.nist.gov/vuln/detail/CVE-2023-29007
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202312-15
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2023 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202210-1202", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.30.6" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.32.0" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.31.0" }, { "model": "git", "scope": "eq", "trust": 1.0, "vendor": "git scm", "version": "2.38.0" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "10.0" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.34.5" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.33.0" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.36.0" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "37" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.36.3" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.35.5" }, { "model": "xcode", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "14.1" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.32.4" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.34.0" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "36" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.35.0" }, { "model": "git", "scope": "gte", "trust": 1.0, "vendor": "git scm", "version": "2.37.0" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.33.5" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.37.4" }, { "model": "git", "scope": "lt", "trust": 1.0, "vendor": "git scm", "version": "2.31.5" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "35" }, { "model": "git", "scope": null, "trust": 0.8, "vendor": "git scm", "version": null }, { "model": "fedora", "scope": null, "trust": 0.8, "vendor": "fedora", "version": null }, { "model": "gnu/linux", "scope": null, "trust": 0.8, "vendor": "debian", "version": null }, { "model": "xcode", "scope": "eq", "trust": 0.8, "vendor": "\u30a2\u30c3\u30d7\u30eb", "version": "14.1" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "NVD", "id": "CVE-2022-39253" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.37.4", "versionStartIncluding": "2.37.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.36.3", "versionStartIncluding": "2.36.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.35.5", "versionStartIncluding": "2.35.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.34.5", "versionStartIncluding": "2.34.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.33.5", "versionStartIncluding": "2.33.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.32.4", "versionStartIncluding": "2.32.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.31.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.30.6", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "14.1", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2022-39253" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Ubuntu", "sources": [ { "db": "PACKETSTORM", "id": "169416" }, { "db": "PACKETSTORM", "id": "171570" }, { "db": "PACKETSTORM", "id": "169954" } ], "trust": 0.3 }, "cve": "CVE-2022-39253", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 2.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "None", "baseScore": 5.5, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2022-39253", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2022-39253", "trust": 1.8, "value": "MEDIUM" }, { "author": "security-advisories@github.com", "id": "CVE-2022-39253", "trust": 1.0, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-202210-1263", "trust": 0.6, "value": "MEDIUM" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "CNNVD", "id": "CNNVD-202210-1263" }, { "db": "NVD", "id": "CVE-2022-39253" }, { "db": "NVD", "id": "CVE-2022-39253" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`. Git SCM of Git Products from several other vendors contain link interpretation vulnerabilities.Information may be obtained. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: git security and bug fix update\nAdvisory ID: RHSA-2023:2319-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2023:2319\nIssue date: 2023-05-09\nCVE Names: CVE-2022-24765 CVE-2022-29187 CVE-2022-39253\n CVE-2022-39260\n====================================================================\n1. Summary:\n\nAn update for git is now available for Red Hat Enterprise Linux 9. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64\n\n3. As opposed to centralized version control systems with a\nclient-server model, Git ensures that each working copy of a Git repository\nis an exact copy with complete revision history. This not only allows the\nuser to work on and contribute to projects without the need to have\npermission to push the changes to their official repositories, but also\nmakes it possible for the user to work with no network connection. \n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly\nin a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor\n(CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to\narbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 9.2 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n2073414 - CVE-2022-24765 git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree\n2107439 - CVE-2022-29187 git: Bypass of safe.directory protections\n2137422 - CVE-2022-39253 git: exposure of sensitive information to a malicious actor\n2137423 - CVE-2022-39260 git: git shell function that splits command arguments can lead to arbitrary heap writes. \n2139379 - Rebase git to 2.39 version [rhel-9.2]\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 9):\n\nSource:\ngit-2.39.1-1.el9.src.rpm\n\naarch64:\ngit-2.39.1-1.el9.aarch64.rpm\ngit-core-2.39.1-1.el9.aarch64.rpm\ngit-core-debuginfo-2.39.1-1.el9.aarch64.rpm\ngit-credential-libsecret-2.39.1-1.el9.aarch64.rpm\ngit-credential-libsecret-debuginfo-2.39.1-1.el9.aarch64.rpm\ngit-daemon-2.39.1-1.el9.aarch64.rpm\ngit-daemon-debuginfo-2.39.1-1.el9.aarch64.rpm\ngit-debuginfo-2.39.1-1.el9.aarch64.rpm\ngit-debugsource-2.39.1-1.el9.aarch64.rpm\ngit-subtree-2.39.1-1.el9.aarch64.rpm\n\nnoarch:\ngit-all-2.39.1-1.el9.noarch.rpm\ngit-core-doc-2.39.1-1.el9.noarch.rpm\ngit-email-2.39.1-1.el9.noarch.rpm\ngit-gui-2.39.1-1.el9.noarch.rpm\ngit-instaweb-2.39.1-1.el9.noarch.rpm\ngit-svn-2.39.1-1.el9.noarch.rpm\ngitk-2.39.1-1.el9.noarch.rpm\ngitweb-2.39.1-1.el9.noarch.rpm\nperl-Git-2.39.1-1.el9.noarch.rpm\nperl-Git-SVN-2.39.1-1.el9.noarch.rpm\n\nppc64le:\ngit-2.39.1-1.el9.ppc64le.rpm\ngit-core-2.39.1-1.el9.ppc64le.rpm\ngit-core-debuginfo-2.39.1-1.el9.ppc64le.rpm\ngit-credential-libsecret-2.39.1-1.el9.ppc64le.rpm\ngit-credential-libsecret-debuginfo-2.39.1-1.el9.ppc64le.rpm\ngit-daemon-2.39.1-1.el9.ppc64le.rpm\ngit-daemon-debuginfo-2.39.1-1.el9.ppc64le.rpm\ngit-debuginfo-2.39.1-1.el9.ppc64le.rpm\ngit-debugsource-2.39.1-1.el9.ppc64le.rpm\ngit-subtree-2.39.1-1.el9.ppc64le.rpm\n\ns390x:\ngit-2.39.1-1.el9.s390x.rpm\ngit-core-2.39.1-1.el9.s390x.rpm\ngit-core-debuginfo-2.39.1-1.el9.s390x.rpm\ngit-credential-libsecret-2.39.1-1.el9.s390x.rpm\ngit-credential-libsecret-debuginfo-2.39.1-1.el9.s390x.rpm\ngit-daemon-2.39.1-1.el9.s390x.rpm\ngit-daemon-debuginfo-2.39.1-1.el9.s390x.rpm\ngit-debuginfo-2.39.1-1.el9.s390x.rpm\ngit-debugsource-2.39.1-1.el9.s390x.rpm\ngit-subtree-2.39.1-1.el9.s390x.rpm\n\nx86_64:\ngit-2.39.1-1.el9.x86_64.rpm\ngit-core-2.39.1-1.el9.x86_64.rpm\ngit-core-debuginfo-2.39.1-1.el9.x86_64.rpm\ngit-credential-libsecret-2.39.1-1.el9.x86_64.rpm\ngit-credential-libsecret-debuginfo-2.39.1-1.el9.x86_64.rpm\ngit-daemon-2.39.1-1.el9.x86_64.rpm\ngit-daemon-debuginfo-2.39.1-1.el9.x86_64.rpm\ngit-debuginfo-2.39.1-1.el9.x86_64.rpm\ngit-debugsource-2.39.1-1.el9.x86_64.rpm\ngit-subtree-2.39.1-1.el9.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2022-24765\nhttps://access.redhat.com/security/cve/CVE-2022-29187\nhttps://access.redhat.com/security/cve/CVE-2022-39253\nhttps://access.redhat.com/security/cve/CVE-2022-39260\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2023 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBZFo03tzjgjWX9erEAQhYSg//bKkon2hHN6jSsXXntqw9ViT5zo9r/KTD\ncV+t7GM4ipVK8j4EW8EnQKrJBWAzsEhqM2vh9MvM/PpTQ2I/JP53YbTed0qgxE3T\nSU07XMVbh1BA7OKyJ+eKfWJLBT03/VzzaepqQPwyHyFDAegJ/L9DlZOkHc9NJrfa\nR+N2Hde/TmUlnRl737ltWtQHE1QSTV1PQZuXb3AEWm6FDe7O62F0GpsuIWj1z8oo\nIIDLHRjp/mCqT6/A70NIRQvcwhLfRYYMOezKL80iGi7WwRokwEScDFE+gzB9FLrf\npjNBFZkQVVxMVYOejArmPuLINaEdZJo/HAOiEtw9gOTzALyKFbWwOHDmSzz1hgbz\nkqFtZgwnpVZNs3UubXCgWeP4aU9xueZeyBHKNQKVERODtrKFt5jbpPrXu6qGyP9O\n6GSgMbUDO5OMqOhTKQiMbKj5gO2DfOIO6vNP5eFwvSXPJG0ZlPIzAJD1cwZdtsVK\nwWBIMfjjc8zUh8OYm+CWg/lgpZLkQxe/wtFcC7Pw1u7nkN95npMXM3O75R8xe1zg\nxsa+wzjCmVRwrO2gLnT7/NUkY3saShCvBD+A82trnasbVlI/49oiojZY1PI3CZtz\nafQDlfLvgygNkV3e5CGe5p9PILwmFbrpALV43dEz6eY+MbeuoE6I7ON8tYtmx4Ds\nhOpSLJjOLjE=YQQZ\n-----END PGP SIGNATURE-----\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2022-11-01-1 Xcode 14.1\n\nXcode 14.1 addresses the following issues. \nInformation about the security content is also available at\nhttps://support.apple.com/HT213496. \n\nGit\nAvailable for: macOS Monterey 12.5 and later\nImpact: Multiple issues in git\nDescription: Multiple issues were addressed by updating to git\nversion 2.32.3. \nCVE-2022-29187: Carlo Marcelo Arenas Bel\u00f3n and Johannes Schindelin\n\nGit\nAvailable for: macOS Monterey 12.5 and later\nImpact: Cloning a malicious repository may result in the disclosure\nof sensitive information\nDescription: This issue was addressed with improved checks. \nCVE-2022-39253: Cory Snider of Mirantis\n\nGit\nAvailable for: macOS Monterey 12.5 and later\nImpact: A remote user may cause an unexpected app termination or\narbitrary code execution if git shell is allowed as a login shell\nDescription: This issue was addressed with improved checks. \nCVE-2022-39260: Kevin Backhouse of the GitHub Security Lab\n\nIDE Xcode Server\nAvailable for: macOS Monterey 12.5 and later\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved input\nvalidation. \nCVE-2022-42797: Tim Michaud (@TimGMichaud) of Moveworks.ai\n\nXcode 14.1 may be obtained from:\nhttps://developer.apple.com/xcode/downloads/ To check that the Xcode\nhas been updated: * Select Xcode in the menu bar * Select About\nXcode * The version after applying this update will be \"Xcode 14.1\". \nAll information is also posted on the Apple Security Updates\nweb site: https://support.apple.com/en-us/HT201222. \n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\nAll information is also posted on the Apple Security Updates\nweb site: https://support.apple.com/en-us/HT201222. ==========================================================================\nUbuntu Security Notice USN-5686-3\nNovember 21, 2022\n\ngit vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.10\n\nSummary:\n\nSeveral security issues were fixed in Git. This update provides the corresponding\nupdates for Ubuntu 22.10. \n\nOriginal advisory details:\n\n Cory Snider discovered that Git incorrectly handled certain symbolic links. \n An attacker could possibly use this issue to cause an unexpected behaviour. \n (CVE-2022-39253)\n\n Kevin Backhouse discovered that Git incorrectly handled certain command strings. \n An attacker could possibly use this issue to arbitrary code execution. \n (CVE-2022-39260)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.10:\n git 1:2.37.2-1ubuntu1.1\n\nIn general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202312-15\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: Git: Multiple Vulnerabilities\n Date: December 27, 2023\n Bugs: #838127, #857831, #877565, #891221, #894472, #905088\n ID: 202312-15\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nSeveral vulnerabilities have been found in Git, the worst of which could\nlead to remote code execution. \n\nAffected packages\n=================\n\nPackage Vulnerable Unaffected\n----------- ------------ ------------\ndev-vcs/git \u003c 2.39.3 \u003e= 2.39.3\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Git. Please review the\nCVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Git users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-vcs/git-2.39.3\"\n\nReferences\n==========\n\n[ 1 ] CVE-2022-23521\n https://nvd.nist.gov/vuln/detail/CVE-2022-23521\n[ 2 ] CVE-2022-24765\n https://nvd.nist.gov/vuln/detail/CVE-2022-24765\n[ 3 ] CVE-2022-29187\n https://nvd.nist.gov/vuln/detail/CVE-2022-29187\n[ 4 ] CVE-2022-39253\n https://nvd.nist.gov/vuln/detail/CVE-2022-39253\n[ 5 ] CVE-2022-39260\n https://nvd.nist.gov/vuln/detail/CVE-2022-39260\n[ 6 ] CVE-2022-41903\n https://nvd.nist.gov/vuln/detail/CVE-2022-41903\n[ 7 ] CVE-2023-22490\n https://nvd.nist.gov/vuln/detail/CVE-2023-22490\n[ 8 ] CVE-2023-23946\n https://nvd.nist.gov/vuln/detail/CVE-2023-23946\n[ 9 ] CVE-2023-25652\n https://nvd.nist.gov/vuln/detail/CVE-2023-25652\n[ 10 ] CVE-2023-25815\n https://nvd.nist.gov/vuln/detail/CVE-2023-25815\n[ 11 ] CVE-2023-29007\n https://nvd.nist.gov/vuln/detail/CVE-2023-29007\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202312-15\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2023 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n", "sources": [ { "db": "NVD", "id": "CVE-2022-39253" }, { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "VULHUB", "id": "VHN-435022" }, { "db": "PACKETSTORM", "id": "169416" }, { "db": "PACKETSTORM", "id": "172366" }, { "db": "PACKETSTORM", "id": "172210" }, { "db": "PACKETSTORM", "id": "171570" }, { "db": "PACKETSTORM", "id": "169735" }, { "db": "PACKETSTORM", "id": "169954" }, { "db": "PACKETSTORM", "id": "176313" } ], "trust": 2.34 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-39253", "trust": 4.0 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2023/02/14/5", "trust": 2.5 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2024/05/14/2", "trust": 1.0 }, { "db": "PACKETSTORM", "id": "169416", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2022-019303", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "170787", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "169735", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "169954", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2022.6094", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2023.0955", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2023.1842", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2022.5479", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202210-1263", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-435022", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "172366", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "172210", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "171570", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "176313", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-435022" }, { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "PACKETSTORM", "id": "169416" }, { "db": "PACKETSTORM", "id": "172366" }, { "db": "PACKETSTORM", "id": "172210" }, { "db": "PACKETSTORM", "id": "171570" }, { "db": "PACKETSTORM", "id": "169735" }, { "db": "PACKETSTORM", "id": "169954" }, { "db": "PACKETSTORM", "id": "176313" }, { "db": "CNNVD", "id": "CNNVD-202210-1263" }, { "db": "NVD", "id": "CVE-2022-39253" } ] }, "id": "VAR-202210-1202", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-435022" } ], "trust": 0.01 }, "last_update_date": "2024-07-23T20:15:03.784000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT213496", "trust": 0.8, "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "title": "Git Post-link vulnerability fixes", "trust": 0.6, "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=211665" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "CNNVD", "id": "CNNVD-202210-1263" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-59", "trust": 1.1 }, { "problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "VULHUB", "id": "VHN-435022" }, { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "NVD", "id": "CVE-2022-39253" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "http://seclists.org/fulldisclosure/2022/nov/1" }, { "trust": 2.5, "url": "http://www.openwall.com/lists/oss-security/2023/02/14/5" }, { "trust": 1.7, "url": "https://support.apple.com/kb/ht213496" }, { "trust": 1.7, "url": "https://github.com/git/git/security/advisories/ghsa-3wp6-j8xr-qw85" }, { "trust": 1.7, "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "trust": 1.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-39253" }, { "trust": 1.1, "url": "https://security.gentoo.org/glsa/202312-15" }, { "trust": 1.0, "url": "http://www.openwall.com/lists/oss-security/2024/05/14/2" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/c7b6jpkx5cgglahxjvqmiznneeb72fhd/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/jmqwgmdlx6ktvww5jzlvpi7icak72tn7/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ohno2fb55cpx47baxmbwubgwho6n6zzh/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ukfhe4kvd7eks5j3ktdfvbeku3clxgvv/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/vfyxctlosesyip72buyd6ecdimum4wmb/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/vfyxctlosesyip72buyd6ecdimum4wmb/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/jmqwgmdlx6ktvww5jzlvpi7icak72tn7/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ohno2fb55cpx47baxmbwubgwho6n6zzh/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ukfhe4kvd7eks5j3ktdfvbeku3clxgvv/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/c7b6jpkx5cgglahxjvqmiznneeb72fhd/" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-39260" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/169954/ubuntu-security-notice-usn-5686-3.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2022.6094" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/169735/apple-security-advisory-2022-11-01-1.html" }, { "trust": 0.6, "url": "https://support.apple.com/en-us/ht213496" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2023.0955" }, { "trust": 0.6, "url": "https://msrc.microsoft.com/update-guide/vulnerability/cve-2022-39253" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2023.1842" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-39253/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2022.5479" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/170787/debian-security-advisory-5332-1.html" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/169416/ubuntu-security-notice-usn-5686-1.html" }, { "trust": 0.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-29187" }, { "trust": 0.3, "url": "https://ubuntu.com/security/notices/usn-5686-1" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-24765" }, { "trust": 0.2, "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2022-39260" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2022-24765" }, { "trust": 0.2, "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "trust": 0.2, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.2, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.2, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2022-39253" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2022-29187" }, { "trust": 0.2, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/git/1:2.25.1-1ubuntu3.6" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/git/1:2.17.1-1ubuntu0.13" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/git/1:2.34.1-1ubuntu1.5" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2023:2859" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2023:2319" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index" }, { "trust": 0.1, "url": "https://ubuntu.com/security/notices/usn-5686-4" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-42797" }, { "trust": 0.1, "url": "https://developer.apple.com/xcode/downloads/" }, { "trust": 0.1, "url": "https://support.apple.com/en-us/ht201222." }, { "trust": 0.1, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.1, "url": "https://support.apple.com/ht213496." }, { "trust": 0.1, "url": "https://ubuntu.com/security/notices/usn-5686-3" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/git/1:2.37.2-1ubuntu1.1" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-29007" }, { "trust": 0.1, "url": "https://bugs.gentoo.org." }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-25815" }, { "trust": 0.1, "url": "https://creativecommons.org/licenses/by-sa/2.5" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-41903" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-23946" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-25652" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-22490" }, { "trust": 0.1, "url": "https://security.gentoo.org/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-23521" } ], "sources": [ { "db": "VULHUB", "id": "VHN-435022" }, { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "PACKETSTORM", "id": "169416" }, { "db": "PACKETSTORM", "id": "172366" }, { "db": "PACKETSTORM", "id": "172210" }, { "db": "PACKETSTORM", "id": "171570" }, { "db": "PACKETSTORM", "id": "169735" }, { "db": "PACKETSTORM", "id": "169954" }, { "db": "PACKETSTORM", "id": "176313" }, { "db": "CNNVD", "id": "CNNVD-202210-1263" }, { "db": "NVD", "id": "CVE-2022-39253" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-435022" }, { "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "db": "PACKETSTORM", "id": "169416" }, { "db": "PACKETSTORM", "id": "172366" }, { "db": "PACKETSTORM", "id": "172210" }, { "db": "PACKETSTORM", "id": "171570" }, { "db": "PACKETSTORM", "id": "169735" }, { "db": "PACKETSTORM", "id": "169954" }, { "db": "PACKETSTORM", "id": "176313" }, { "db": "CNNVD", "id": "CNNVD-202210-1263" }, { "db": "NVD", "id": "CVE-2022-39253" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-10-19T00:00:00", "db": "VULHUB", "id": "VHN-435022" }, { "date": "2023-10-25T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "date": "2022-10-18T22:32:05", "db": "PACKETSTORM", "id": "169416" }, { "date": "2023-05-16T17:08:14", "db": "PACKETSTORM", "id": "172366" }, { "date": "2023-05-09T15:18:13", "db": "PACKETSTORM", "id": "172210" }, { "date": "2023-03-29T10:13:26", "db": "PACKETSTORM", "id": "171570" }, { "date": "2022-11-08T13:42:03", "db": "PACKETSTORM", "id": "169735" }, { "date": "2022-11-21T15:22:01", "db": "PACKETSTORM", "id": "169954" }, { "date": "2023-12-27T14:55:24", "db": "PACKETSTORM", "id": "176313" }, { "date": "2022-10-18T00:00:00", "db": "CNNVD", "id": "CNNVD-202210-1263" }, { "date": "2022-10-19T11:15:11.227000", "db": "NVD", "id": "CVE-2022-39253" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-02-16T00:00:00", "db": "VULHUB", "id": "VHN-435022" }, { "date": "2023-10-25T05:25:00", "db": "JVNDB", "id": "JVNDB-2022-019303" }, { "date": "2023-03-29T00:00:00", "db": "CNNVD", "id": "CNNVD-202210-1263" }, { "date": "2024-06-10T18:15:19.643000", "db": "NVD", "id": "CVE-2022-39253" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "CNNVD", "id": "CNNVD-202210-1263" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Git\u00a0SCM\u00a0 of \u00a0Git\u00a0 Link interpretation vulnerabilities in products from multiple other vendors", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019303" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "post link", "sources": [ { "db": "CNNVD", "id": "CNNVD-202210-1263" } ], "trust": 0.6 } }
rhsa-2024_0407
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\n* git: data exfiltration with maliciously crafted repository (CVE-2023-22490)\n\n* git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:0407", "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2168160", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168160" }, { "category": "external", "summary": "2168161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168161" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0407.json" } ], "title": "Red Hat Security Advisory: git security update", "tracking": { "current_release_date": "2024-11-06T04:48:41+00:00", "generator": { "date": "2024-11-06T04:48:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:0407", "initial_release_date": "2024-01-25T08:01:33+00:00", "revision_history": [ { "date": "2024-01-25T08:01:33+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-01-25T08:01:33+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:48:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.src", "product": { "name": "git-0:2.31.8-1.el8_6.src", "product_id": "git-0:2.31.8-1.el8_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-0:2.31.8-1.el8_6.aarch64", "product_id": "git-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-core-0:2.31.8-1.el8_6.aarch64", "product_id": "git-core-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.aarch64", "product_id": "git-daemon-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.aarch64", "product_id": "git-subtree-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "product_id": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-core-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-core-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-0:2.31.8-1.el8_6.x86_64", "product_id": "git-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-core-0:2.31.8-1.el8_6.x86_64", "product_id": "git-core-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.x86_64", "product_id": "git-daemon-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.x86_64", "product_id": "git-subtree-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "product_id": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-0:2.31.8-1.el8_6.s390x", "product_id": "git-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-core-0:2.31.8-1.el8_6.s390x", "product_id": "git-core-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.s390x", "product_id": "git-daemon-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.s390x", "product_id": "git-subtree-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.s390x", "product_id": "git-debugsource-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-all-0:2.31.8-1.el8_6.noarch", "product_id": "git-all-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-core-doc-0:2.31.8-1.el8_6.noarch", "product_id": "git-core-doc-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-email-0:2.31.8-1.el8_6.noarch", "product_id": "git-email-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-gui-0:2.31.8-1.el8_6.noarch", "product_id": "git-gui-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-instaweb-0:2.31.8-1.el8_6.noarch", "product_id": "git-instaweb-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-svn-0:2.31.8-1.el8_6.noarch", "product_id": "git-svn-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.31.8-1.el8_6.noarch", "product": { "name": "gitk-0:2.31.8-1.el8_6.noarch", "product_id": "gitk-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.31.8-1.el8_6.noarch", "product": { "name": "gitweb-0:2.31.8-1.el8_6.noarch", "product_id": "gitweb-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.31.8-1.el8_6.noarch", "product": { "name": "perl-Git-0:2.31.8-1.el8_6.noarch", "product_id": "perl-Git-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "product": { "name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "product_id": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.31.8-1.el8_6?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src" }, "product_reference": "git-0:2.31.8-1.el8_6.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-all-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-core-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-core-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-core-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-core-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-core-doc-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-email-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-gui-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-instaweb-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-svn-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch" }, "product_reference": "gitk-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch" }, "product_reference": "gitweb-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch" }, "product_reference": "perl-Git-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" }, "product_reference": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." }, { "cve": "CVE-2023-22490", "cwe": { "id": "CWE-402", "name": "Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)" }, "discovery_date": "2023-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168160" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links (CVE-2022-39253), the objects directory may still be a symbolic link.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: data exfiltration with maliciously crafted repository", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-22490" }, { "category": "external", "summary": "RHBZ#2168160", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168160" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-22490", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22490" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-22490", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22490" }, { "category": "external", "summary": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/", "url": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/" }, { "category": "external", "summary": "https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q", "url": "https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q" } ], "release_date": "2023-02-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "- Avoid cloning repositories from untrusted sources with --recurse-submodules.\n- Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update at each layer. Before doing so, inspect each new .gitmodules file to ensure that it does not contain suspicious module URLs.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: data exfiltration with maliciously crafted repository" }, { "cve": "CVE-2023-23946", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2023-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168161" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This security issue occurs when feeding a crafted input to \"git apply.\" A path outside the working tree can be overwritten by the user running \"git apply.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git apply: a path outside the working tree can be overwritten with crafted input", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability marked as Moderate severity and it\u0027s less likely to be exploitable because it requires a specially crafted malicious patch to be applied via git apply, to overwrite files outside the working tree of the user running git apply. This could lead to some compromise of integrity of resources under certain circumstances, however it does not compromise the whole system or gain additional privileges to execute arbitrary code, or allow remote users to cause a denial of service.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23946" }, { "category": "external", "summary": "RHBZ#2168161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168161" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23946", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23946" }, { "category": "external", "summary": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/", "url": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/" }, { "category": "external", "summary": "https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh", "url": "https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh" } ], "release_date": "2023-02-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "Use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git apply: a path outside the working tree can be overwritten with crafted input" } ] }
rhsa-2023_2859
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2859", "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139378" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2859.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-06T02:58:51+00:00", "generator": { "date": "2024-11-06T02:58:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:2859", "initial_release_date": "2023-05-16T08:32:51+00:00", "revision_history": [ { "date": "2023-05-16T08:32:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-16T08:32:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T02:58:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.src", "product": { "name": "git-0:2.39.1-1.el8.src", "product_id": "git-0:2.39.1-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.aarch64", "product": { "name": "git-0:2.39.1-1.el8.aarch64", "product_id": "git-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.aarch64", "product": { "name": "git-core-0:2.39.1-1.el8.aarch64", "product_id": "git-core-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el8.aarch64", "product_id": "git-daemon-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el8.aarch64", "product_id": "git-subtree-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el8.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-0:2.39.1-1.el8.ppc64le", "product_id": "git-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el8.ppc64le", "product_id": "git-core-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el8.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el8.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.x86_64", "product": { "name": "git-0:2.39.1-1.el8.x86_64", "product_id": "git-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.x86_64", "product": { "name": "git-core-0:2.39.1-1.el8.x86_64", "product_id": "git-core-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el8.x86_64", "product_id": "git-daemon-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el8.x86_64", "product_id": "git-subtree-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el8.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.s390x", "product": { "name": "git-0:2.39.1-1.el8.s390x", "product_id": "git-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.s390x", "product": { "name": "git-core-0:2.39.1-1.el8.s390x", "product_id": "git-core-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el8.s390x", "product_id": "git-daemon-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el8.s390x", "product_id": "git-subtree-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el8.s390x", "product_id": "git-debugsource-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el8.noarch", "product": { "name": "git-all-0:2.39.1-1.el8.noarch", "product_id": "git-all-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el8.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el8.noarch", "product_id": "git-core-doc-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el8.noarch", "product": { "name": "git-email-0:2.39.1-1.el8.noarch", "product_id": "git-email-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el8.noarch", "product": { "name": "git-gui-0:2.39.1-1.el8.noarch", "product_id": "git-gui-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el8.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el8.noarch", "product_id": "git-instaweb-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el8.noarch", "product": { "name": "git-svn-0:2.39.1-1.el8.noarch", "product_id": "git-svn-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el8.noarch", "product": { "name": "gitk-0:2.39.1-1.el8.noarch", "product_id": "gitk-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el8.noarch", "product": { "name": "gitweb-0:2.39.1-1.el8.noarch", "product_id": "gitweb-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el8.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el8.noarch", "product_id": "perl-Git-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x" }, "product_reference": "git-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src" }, "product_reference": "git-0:2.39.1-1.el8.src", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch" }, "product_reference": "git-all-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x" }, "product_reference": "git-core-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch" }, "product_reference": "git-email-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch" }, "product_reference": "gitk-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." } ] }
rhsa-2023_2319
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2319", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2319.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-06T02:54:06+00:00", "generator": { "date": "2024-11-06T02:54:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:2319", "initial_release_date": "2023-05-09T10:03:04+00:00", "revision_history": [ { "date": "2023-05-09T10:03:04+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-09T10:03:04+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T02:54:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.src", "product": { "name": "git-0:2.39.1-1.el9.src", "product_id": "git-0:2.39.1-1.el9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.aarch64", "product": { "name": "git-0:2.39.1-1.el9.aarch64", "product_id": "git-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-0:2.39.1-1.el9.aarch64", "product_id": "git-core-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product_id": "git-subtree-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-0:2.39.1-1.el9.ppc64le", "product_id": "git-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.x86_64", "product": { "name": "git-0:2.39.1-1.el9.x86_64", "product_id": "git-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-0:2.39.1-1.el9.x86_64", "product_id": "git-core-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product_id": "git-subtree-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.s390x", "product": { "name": "git-0:2.39.1-1.el9.s390x", "product_id": "git-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-0:2.39.1-1.el9.s390x", "product_id": "git-core-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el9.s390x", "product_id": "git-subtree-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product_id": "git-debugsource-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el9.noarch", "product": { "name": "git-all-0:2.39.1-1.el9.noarch", "product_id": "git-all-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product_id": "git-core-doc-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el9.noarch", "product": { "name": "git-email-0:2.39.1-1.el9.noarch", "product_id": "git-email-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el9.noarch", "product": { "name": "git-gui-0:2.39.1-1.el9.noarch", "product_id": "git-gui-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product_id": "git-instaweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el9.noarch", "product": { "name": "git-svn-0:2.39.1-1.el9.noarch", "product_id": "git-svn-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el9.noarch", "product": { "name": "gitk-0:2.39.1-1.el9.noarch", "product_id": "gitk-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el9.noarch", "product": { "name": "gitweb-0:2.39.1-1.el9.noarch", "product_id": "gitweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x" }, "product_reference": "git-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src" }, "product_reference": "git-0:2.39.1-1.el9.src", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch" }, "product_reference": "git-all-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch" }, "product_reference": "git-email-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch" }, "product_reference": "gitk-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." } ] }
wid-sec-w-2022-1790
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Git ist eine freie Software zur verteilten Versionsverwaltung von Dateien.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in git ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Code auszuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-1790 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1790.json" }, { "category": "self", "summary": "WID-SEC-2022-1790 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1790" }, { "category": "external", "summary": "OSS Seclist.org Vulnerability Description vom 2022-10-18", "url": "https://seclists.org/oss-sec/2022/q4/31" }, { "category": "external", "summary": "Apple Security Advisory HT213496 vom 2022-11-01", "url": "https://support.apple.com/kb/HT213496" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:3931-1 vom 2022-11-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012868.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-2 vom 2022-11-17", "url": "https://ubuntu.com/security/notices/USN-5686-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-3 vom 2022-11-21", "url": "https://ubuntu.com/security/notices/USN-5686-3" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4271-1 vom 2022-11-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013141.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1886 vom 2022-12-07", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1886.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1653 vom 2022-12-10", "url": "https://alas.aws.amazon.com/ALAS-2022-1653.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-254 vom 2022-12-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-254.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-3239 vom 2022-12-13", "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5332 vom 2023-01-29", "url": "https://lists.debian.org/debian-security-announce/2023/msg00022.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0418-1 vom 2023-02-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013768.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2-2023-1984 vom 2023-03-07", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1984.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1700 vom 2023-03-07", "url": "https://alas.aws.amazon.com/ALAS-2023-1700.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0407 vom 2024-01-25", "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-4 vom 2023-03-28", "url": "https://ubuntu.com/security/notices/USN-5686-4" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2319 vom 2023-05-09", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2859 vom 2023-05-16", "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "external", "summary": "Dell Security Advisory DSA-2023-069 vom 2023-07-21", "url": "https://www.dell.com/support/kbdoc/de-de/000210964/dsa-2023-069-dell-networker-vproxy-security-update-for-multiple-vulnerabilities-detected-on-vproxy-4-3-0-38" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202312-15 vom 2023-12-27", "url": "https://security.gentoo.org/glsa/202312-15" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-2548 vom 2024-05-30", "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2548.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-1939 vom 2024-05-30", "url": "https://alas.aws.amazon.com/ALAS-2024-1939.html" } ], "source_lang": "en-US", "title": "git: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-30T22:00:00.000+00:00", "generator": { "date": "2024-05-31T10:06:35.793+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-1790", "initial_release_date": "2022-10-18T22:00:00.000+00:00", "revision_history": [ { "date": "2022-10-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-10-19T22:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2022-53AADD995F, FEDORA-2022-8B58806840" }, { "date": "2022-10-20T22:00:00.000+00:00", "number": "3", "summary": "Referenz(en) aufgenommen: FEDORA-2022-2C33BBA286" }, { "date": "2022-11-01T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Apple aufgenommen" }, { "date": "2022-11-10T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-11-17T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-11-21T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-11-29T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-06T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-11T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-13T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-01-29T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-02-15T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-03-06T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-07T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-28T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-05-09T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-16T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-23T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2023-12-27T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2024-01-25T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-30T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Amazon aufgenommen" } ], "status": "final", "version": "22" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c14.1", "product": { "name": "Apple Xcode \u003c14.1", "product_id": "T025171", "product_identification_helper": { "cpe": "cpe:/a:apple:xcode:14.1" } } } ], "category": "product_name", "name": "Xcode" } ], "category": "vendor", "name": "Apple" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vProxy \u003c4.3.0-40", "product": { "name": "Dell NetWorker vProxy \u003c4.3.0-40", "product_id": "T028847", "product_identification_helper": { "cpe": "cpe:/a:dell:networker:vproxy__4.3.0-40" } } } ], "category": "product_name", "name": "NetWorker" } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c2.30.6", "product": { "name": "Open Source git \u003c2.30.6", "product_id": "T025037", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.30.6" } } }, { "category": "product_version_range", "name": "\u003c2.31.5", "product": { "name": "Open Source git \u003c2.31.5", "product_id": "T025038", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.31.5" } } }, { "category": "product_version_range", "name": "\u003c2.32.4", "product": { "name": "Open Source git \u003c2.32.4", "product_id": "T025039", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.32.4" } } }, { "category": "product_version_range", "name": "\u003c2.33.5", "product": { "name": "Open Source git \u003c2.33.5", "product_id": "T025040", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.33.5" } } }, { "category": "product_version_range", "name": "\u003c2.34.5", "product": { "name": "Open Source git \u003c2.34.5", "product_id": "T025041", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.34.5" } } }, { "category": "product_version_range", "name": "\u003c2.35.5", "product": { "name": "Open Source git \u003c2.35.5", "product_id": "T025042", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.35.5" } } }, { "category": "product_version_range", "name": "\u003c2.36.3", "product": { "name": "Open Source git \u003c2.36.3", "product_id": "T025043", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.36.3" } } }, { "category": "product_version_range", "name": "\u003c2.37.4", "product": { "name": "Open Source git \u003c2.37.4", "product_id": "T025044", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.37.4" } } }, { "category": "product_version_range", "name": "\u003c2.38.1", "product": { "name": "Open Source git \u003c2.38.1", "product_id": "T025045", "product_identification_helper": { "cpe": "cpe:/a:open_source:git:2.38.1" } } } ], "category": "product_name", "name": "git" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in git. Der Fehler besteht aufgrund eines \u00fcberraschenden Verhaltens, wenn beliebige Dateien im \"$GIT_DIR\" eines Repositorys vorhanden sind und von einem b\u00f6sartigen Repository geklont wird. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T025171", "2951", "T002207", "67646", "T000126", "T028847", "398363", "T012167" ] }, "release_date": "2022-10-18T22:00:00Z", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in git. Der Fehler besteht, wenn eine zu lange Befehlszeichenfolge an die Git-Shell \u00fcbergeben wird. Dies kann zu einem \u00dcberlauf in der Funktion \"split_cmdline()\" f\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen." } ], "product_status": { "known_affected": [ "T025171", "2951", "T002207", "67646", "T000126", "T028847", "398363", "T012167" ] }, "release_date": "2022-10-18T22:00:00Z", "title": "CVE-2022-39260" } ] }
wid-sec-w-2023-1424
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1424 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1424.json" }, { "category": "self", "summary": "WID-SEC-2023-1424 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1424" }, { "category": "external", "summary": "Xerox Security Bulletin vom 2023-06-12", "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2023/06/Xerox-Security-Bulletin-XRX23-009-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server f\u00fcr Solaris: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-12T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:30:41.322+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1424", "initial_release_date": "2023-06-12T22:00:00.000+00:00", "revision_history": [ { "date": "2023-06-12T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server v9 for Solaris", "product": { "name": "Xerox FreeFlow Print Server v9 for Solaris", "product_id": "T028053", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v9_for_solaris" } } } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-28708", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-28708" }, { "cve": "CVE-2023-28176", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-28176" }, { "cve": "CVE-2023-28164", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-28164" }, { "cve": "CVE-2023-28163", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-28163" }, { "cve": "CVE-2023-28162", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-28162" }, { "cve": "CVE-2023-27522", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-27522" }, { "cve": "CVE-2023-25752", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25752" }, { "cve": "CVE-2023-25751", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25751" }, { "cve": "CVE-2023-25746", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25746" }, { "cve": "CVE-2023-25744", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25744" }, { "cve": "CVE-2023-25743", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25743" }, { "cve": "CVE-2023-25742", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25742" }, { "cve": "CVE-2023-25739", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25739" }, { "cve": "CVE-2023-25738", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25738" }, { "cve": "CVE-2023-25737", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25737" }, { "cve": "CVE-2023-25735", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25735" }, { "cve": "CVE-2023-25734", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25734" }, { "cve": "CVE-2023-25732", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25732" }, { "cve": "CVE-2023-25730", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25730" }, { "cve": "CVE-2023-25729", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25729" }, { "cve": "CVE-2023-25728", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25728" }, { "cve": "CVE-2023-25690", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-25690" }, { "cve": "CVE-2023-24998", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-24998" }, { "cve": "CVE-2023-24807", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-24807" }, { "cve": "CVE-2023-24580", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-24580" }, { "cve": "CVE-2023-23969", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23969" }, { "cve": "CVE-2023-23946", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23946" }, { "cve": "CVE-2023-23936", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23936" }, { "cve": "CVE-2023-23920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23920" }, { "cve": "CVE-2023-23919", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23919" }, { "cve": "CVE-2023-23918", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23918" }, { "cve": "CVE-2023-23605", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23605" }, { "cve": "CVE-2023-23603", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23603" }, { "cve": "CVE-2023-23602", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23602" }, { "cve": "CVE-2023-23601", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23601" }, { "cve": "CVE-2023-23599", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23599" }, { "cve": "CVE-2023-23598", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-23598" }, { "cve": "CVE-2023-22809", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-22809" }, { "cve": "CVE-2023-22490", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-22490" }, { "cve": "CVE-2023-22003", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-22003" }, { "cve": "CVE-2023-21985", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21985" }, { "cve": "CVE-2023-21984", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21984" }, { "cve": "CVE-2023-21928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21928" }, { "cve": "CVE-2023-21896", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21896" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21840", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21840" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-21830" }, { "cve": "CVE-2023-0804", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0804" }, { "cve": "CVE-2023-0803", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0803" }, { "cve": "CVE-2023-0802", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0802" }, { "cve": "CVE-2023-0801", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0801" }, { "cve": "CVE-2023-0800", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0800" }, { "cve": "CVE-2023-0799", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0799" }, { "cve": "CVE-2023-0798", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0798" }, { "cve": "CVE-2023-0797", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0797" }, { "cve": "CVE-2023-0796", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0796" }, { "cve": "CVE-2023-0795", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0795" }, { "cve": "CVE-2023-0767", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0767" }, { "cve": "CVE-2023-0662", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0662" }, { "cve": "CVE-2023-0616", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0616" }, { "cve": "CVE-2023-0568", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0568" }, { "cve": "CVE-2023-0567", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0567" }, { "cve": "CVE-2023-0430", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0430" }, { "cve": "CVE-2023-0417", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0417" }, { "cve": "CVE-2023-0416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0416" }, { "cve": "CVE-2023-0415", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0415" }, { "cve": "CVE-2023-0414", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0414" }, { "cve": "CVE-2023-0413", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0413" }, { "cve": "CVE-2023-0412", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0412" }, { "cve": "CVE-2023-0411", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0411" }, { "cve": "CVE-2023-0401", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0401" }, { "cve": "CVE-2023-0286", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0286" }, { "cve": "CVE-2023-0217", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0217" }, { "cve": "CVE-2023-0216", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0216" }, { "cve": "CVE-2023-0215", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2023-0215" }, { "cve": "CVE-2022-48281", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-48281" }, { "cve": "CVE-2022-46877", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46877" }, { "cve": "CVE-2022-46874", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46874" }, { "cve": "CVE-2022-46871", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46871" }, { "cve": "CVE-2022-46344", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46344" }, { "cve": "CVE-2022-46343", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46343" }, { "cve": "CVE-2022-46342", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46342" }, { "cve": "CVE-2022-46341", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46341" }, { "cve": "CVE-2022-46340", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-46340" }, { "cve": "CVE-2022-45939", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-45939" }, { "cve": "CVE-2022-45199", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-45199" }, { "cve": "CVE-2022-45143", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-45143" }, { "cve": "CVE-2022-4450", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-4450" }, { "cve": "CVE-2022-4345", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-4345" }, { "cve": "CVE-2022-4304", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-4304" }, { "cve": "CVE-2022-42919", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42919" }, { "cve": "CVE-2022-42916", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42916" }, { "cve": "CVE-2022-42915", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42915" }, { "cve": "CVE-2022-42898", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42898" }, { "cve": "CVE-2022-4283", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-4283" }, { "cve": "CVE-2022-4203", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-4203" }, { "cve": "CVE-2022-42012", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42012" }, { "cve": "CVE-2022-42011", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42011" }, { "cve": "CVE-2022-42010", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-42010" }, { "cve": "CVE-2022-41903", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-41903" }, { "cve": "CVE-2022-41716", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-41716" }, { "cve": "CVE-2022-41715", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-41715" }, { "cve": "CVE-2022-40898", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-40898" }, { "cve": "CVE-2022-40304", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-40304" }, { "cve": "CVE-2022-40303", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-40303" }, { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-3924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3924" }, { "cve": "CVE-2022-38784", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-38784" }, { "cve": "CVE-2022-38171", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-38171" }, { "cve": "CVE-2022-37436", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-37436" }, { "cve": "CVE-2022-3736", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3736" }, { "cve": "CVE-2022-3705", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3705" }, { "cve": "CVE-2022-36760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-36760" }, { "cve": "CVE-2022-36227", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-36227" }, { "cve": "CVE-2022-36114", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-36114" }, { "cve": "CVE-2022-36113", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-36113" }, { "cve": "CVE-2022-35260", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-35260" }, { "cve": "CVE-2022-35252", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-35252" }, { "cve": "CVE-2022-3515", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3515" }, { "cve": "CVE-2022-3352", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3352" }, { "cve": "CVE-2022-3324", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3324" }, { "cve": "CVE-2022-3297", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3297" }, { "cve": "CVE-2022-3296", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3296" }, { "cve": "CVE-2022-3278", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3278" }, { "cve": "CVE-2022-3256", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3256" }, { "cve": "CVE-2022-3235", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3235" }, { "cve": "CVE-2022-3234", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3234" }, { "cve": "CVE-2022-32221", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32221" }, { "cve": "CVE-2022-32208", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32208" }, { "cve": "CVE-2022-32207", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32207" }, { "cve": "CVE-2022-32206", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32206" }, { "cve": "CVE-2022-32205", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32205" }, { "cve": "CVE-2022-32190", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32190" }, { "cve": "CVE-2022-32189", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32189" }, { "cve": "CVE-2022-32148", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-32148" }, { "cve": "CVE-2022-3153", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3153" }, { "cve": "CVE-2022-3134", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3134" }, { "cve": "CVE-2022-3099", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3099" }, { "cve": "CVE-2022-3094", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3094" }, { "cve": "CVE-2022-30635", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30635" }, { "cve": "CVE-2022-30634", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30634" }, { "cve": "CVE-2022-30633", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30633" }, { "cve": "CVE-2022-30632", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30632" }, { "cve": "CVE-2022-30631", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30631" }, { "cve": "CVE-2022-30630", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30630" }, { "cve": "CVE-2022-30629", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30629" }, { "cve": "CVE-2022-30580", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-30580" }, { "cve": "CVE-2022-3037", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3037" }, { "cve": "CVE-2022-3016", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-3016" }, { "cve": "CVE-2022-29804", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-29804" }, { "cve": "CVE-2022-2980", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2980" }, { "cve": "CVE-2022-29526", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-29526" }, { "cve": "CVE-2022-2946", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2946" }, { "cve": "CVE-2022-2929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2929" }, { "cve": "CVE-2022-2928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2928" }, { "cve": "CVE-2022-2923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2923" }, { "cve": "CVE-2022-2889", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2889" }, { "cve": "CVE-2022-2880", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2880" }, { "cve": "CVE-2022-2879", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2879" }, { "cve": "CVE-2022-2874", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2874" }, { "cve": "CVE-2022-2862", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2862" }, { "cve": "CVE-2022-2849", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2849" }, { "cve": "CVE-2022-2845", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2845" }, { "cve": "CVE-2022-28331", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-28331" }, { "cve": "CVE-2022-28327", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-28327" }, { "cve": "CVE-2022-2819", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2819" }, { "cve": "CVE-2022-2817", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2817" }, { "cve": "CVE-2022-2816", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2816" }, { "cve": "CVE-2022-28131", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-28131" }, { "cve": "CVE-2022-27778", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-27778" }, { "cve": "CVE-2022-27664", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-27664" }, { "cve": "CVE-2022-27536", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-27536" }, { "cve": "CVE-2022-27337", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-27337" }, { "cve": "CVE-2022-25255", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-25255" }, { "cve": "CVE-2022-25147", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-25147" }, { "cve": "CVE-2022-24963", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-24963" }, { "cve": "CVE-2022-24675", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-24675" }, { "cve": "CVE-2022-23521", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-23521" }, { "cve": "CVE-2022-2309", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-2309" }, { "cve": "CVE-2022-21515", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-21515" }, { "cve": "CVE-2022-21349", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-21349" }, { "cve": "CVE-2022-21291", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-21291" }, { "cve": "CVE-2022-1962", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-1962" }, { "cve": "CVE-2022-1705", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-1705" }, { "cve": "CVE-2022-1292", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-1292" }, { "cve": "CVE-2022-1122", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-1122" }, { "cve": "CVE-2022-0718", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2022-0718" }, { "cve": "CVE-2021-37750", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2021-37750" }, { "cve": "CVE-2021-37519", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2021-37519" }, { "cve": "CVE-2021-35940", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2021-35940" }, { "cve": "CVE-2021-30860", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2021-30860" }, { "cve": "CVE-2021-29338", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2021-29338" }, { "cve": "CVE-2018-25032", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2018-25032" }, { "cve": "CVE-2017-12613", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2017-12613" }, { "cve": "CVE-2006-20001", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T028053" ] }, "release_date": "2023-06-12T22:00:00Z", "title": "CVE-2006-20001" } ] }
wid-sec-w-2023-0561
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0561 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0561.json" }, { "category": "self", "summary": "WID-SEC-2023-0561 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0561" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-007 vom 2023-05-18", "url": "https://security.business.xerox.com/wp-content/uploads/2023/05/Xerox-Security-Bulletin-XRX23-007-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-005 vom 2023-04-04", "url": "https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-002 vom 2023-03-23", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-002-FreeFlow-Print-Server-v2_Windows10.pdf" }, { "category": "external", "summary": "Xerox Mini Bulletin XRX21A vom 2023-03-02", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-001-FreeFlow%C2%AE-Print-Server-v7.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-05-18T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:17:56.928+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0561", "initial_release_date": "2023-03-02T23:00:00.000+00:00", "revision_history": [ { "date": "2023-03-02T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-03-22T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-04-03T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server 7", "product": { "name": "Xerox FreeFlow Print Server 7", "product_id": "T000872", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:7" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server 9", "product": { "name": "Xerox FreeFlow Print Server 9", "product_id": "T002977", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:9" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server v2", "product": { "name": "Xerox FreeFlow Print Server v2", "product_id": "T014888", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v2" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-21900", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21900" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21835", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21835" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21830" }, { "cve": "CVE-2022-46882", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46882" }, { "cve": "CVE-2022-46881", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46881" }, { "cve": "CVE-2022-46880", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46880" }, { "cve": "CVE-2022-46878", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46878" }, { "cve": "CVE-2022-46875", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46875" }, { "cve": "CVE-2022-46874", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46874" }, { "cve": "CVE-2022-46872", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46872" }, { "cve": "CVE-2022-45421", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45421" }, { "cve": "CVE-2022-45420", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45420" }, { "cve": "CVE-2022-45419", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45419" }, { "cve": "CVE-2022-45418", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45418" }, { "cve": "CVE-2022-45417", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45417" }, { "cve": "CVE-2022-45416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45416" }, { "cve": "CVE-2022-45415", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45415" }, { "cve": "CVE-2022-45414", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45414" }, { "cve": "CVE-2022-45413", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45413" }, { "cve": "CVE-2022-45412", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45412" }, { "cve": "CVE-2022-45411", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45411" }, { "cve": "CVE-2022-45410", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45410" }, { "cve": "CVE-2022-45409", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45409" }, { "cve": "CVE-2022-45408", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45408" }, { "cve": "CVE-2022-45407", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45407" }, { "cve": "CVE-2022-45406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45406" }, { "cve": "CVE-2022-45405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45405" }, { "cve": "CVE-2022-45404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45404" }, { "cve": "CVE-2022-45403", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45403" }, { "cve": "CVE-2022-45063", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45063" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-44638", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-44638" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-43548" }, { "cve": "CVE-2022-42932", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42932" }, { "cve": "CVE-2022-42929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42929" }, { "cve": "CVE-2022-42928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42928" }, { "cve": "CVE-2022-42927", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42927" }, { "cve": "CVE-2022-42252", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42252" }, { "cve": "CVE-2022-41556", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-41556" }, { "cve": "CVE-2022-41323", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-41323" }, { "cve": "CVE-2022-40962", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40962" }, { "cve": "CVE-2022-40960", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40960" }, { "cve": "CVE-2022-40959", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40959" }, { "cve": "CVE-2022-40958", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40958" }, { "cve": "CVE-2022-40957", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40957" }, { "cve": "CVE-2022-40956", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40956" }, { "cve": "CVE-2022-40674", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40674" }, { "cve": "CVE-2022-3970", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3970" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-39260" }, { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-3786", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3786" }, { "cve": "CVE-2022-37797", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-37797" }, { "cve": "CVE-2022-37454", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-37454" }, { "cve": "CVE-2022-37436", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-37436" }, { "cve": "CVE-2022-36760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-36760" }, { "cve": "CVE-2022-3627", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3627" }, { "cve": "CVE-2022-3626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3626" }, { "cve": "CVE-2022-36087", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-36087" }, { "cve": "CVE-2022-36059", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-36059" }, { "cve": "CVE-2022-3602", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3602" }, { "cve": "CVE-2022-3599", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3599" }, { "cve": "CVE-2022-3598", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3598" }, { "cve": "CVE-2022-3597", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3597" }, { "cve": "CVE-2022-3570", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3570" }, { "cve": "CVE-2022-35256", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-35256" }, { "cve": "CVE-2022-35255", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-35255" }, { "cve": "CVE-2022-34526", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-34526" }, { "cve": "CVE-2022-3276", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3276" }, { "cve": "CVE-2022-32222", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32222" }, { "cve": "CVE-2022-32215", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32215" }, { "cve": "CVE-2022-32213", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32213" }, { "cve": "CVE-2022-32212", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32212" }, { "cve": "CVE-2022-3204", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3204" }, { "cve": "CVE-2022-3190", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3190" }, { "cve": "CVE-2022-31630", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-31630" }, { "cve": "CVE-2022-31629", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-31629" }, { "cve": "CVE-2022-31628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-31628" }, { "cve": "CVE-2022-3155", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3155" }, { "cve": "CVE-2022-3034", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3034" }, { "cve": "CVE-2022-3033", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3033" }, { "cve": "CVE-2022-3032", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3032" }, { "cve": "CVE-2022-29458", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-29458" }, { "cve": "CVE-2022-29187", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-29187" }, { "cve": "CVE-2022-29154", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-29154" }, { "cve": "CVE-2022-2869", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2869" }, { "cve": "CVE-2022-2868", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2868" }, { "cve": "CVE-2022-2867", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2867" }, { "cve": "CVE-2022-27406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-27406" }, { "cve": "CVE-2022-27405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-27405" }, { "cve": "CVE-2022-27404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-27404" }, { "cve": "CVE-2022-26981", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-26981" }, { "cve": "CVE-2022-24765", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-24765" }, { "cve": "CVE-2022-24070", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-24070" }, { "cve": "CVE-2022-23901", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-23901" }, { "cve": "CVE-2022-22844", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-22844" }, { "cve": "CVE-2022-2210", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2210" }, { "cve": "CVE-2022-2208", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2208" }, { "cve": "CVE-2022-2207", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2207" }, { "cve": "CVE-2022-2206", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2206" }, { "cve": "CVE-2022-2183", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2183" }, { "cve": "CVE-2022-2175", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2175" }, { "cve": "CVE-2022-21658", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21658" }, { "cve": "CVE-2022-21628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21628" }, { "cve": "CVE-2022-21626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21626" }, { "cve": "CVE-2022-21624", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21624" }, { "cve": "CVE-2022-21619", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21619" }, { "cve": "CVE-2022-2125", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2125" }, { "cve": "CVE-2022-2122", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2122" }, { "cve": "CVE-2022-2058", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2058" }, { "cve": "CVE-2022-2057", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2057" }, { "cve": "CVE-2022-2056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2056" }, { "cve": "CVE-2022-1925", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1925" }, { "cve": "CVE-2022-1924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1924" }, { "cve": "CVE-2022-1923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1923" }, { "cve": "CVE-2022-1922", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1922" }, { "cve": "CVE-2022-1921", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1921" }, { "cve": "CVE-2022-1920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1920" }, { "cve": "CVE-2022-1348", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1348" }, { "cve": "CVE-2022-1056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1056" }, { "cve": "CVE-2022-0924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0924" }, { "cve": "CVE-2022-0909", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0909" }, { "cve": "CVE-2022-0908", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0908" }, { "cve": "CVE-2022-0907", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0907" }, { "cve": "CVE-2022-0891", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0891" }, { "cve": "CVE-2022-0865", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0865" }, { "cve": "CVE-2022-0562", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0562" }, { "cve": "CVE-2022-0561", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0561" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-46848" }, { "cve": "CVE-2021-46823", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-46823" }, { "cve": "CVE-2021-42694", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-42694" }, { "cve": "CVE-2021-42574", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-42574" }, { "cve": "CVE-2021-37750", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-37750" }, { "cve": "CVE-2021-28544", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-28544" }, { "cve": "CVE-2020-10735", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2020-10735" }, { "cve": "CVE-2019-6111", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2019-6111" }, { "cve": "CVE-2018-7160", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2018-7160" }, { "cve": "CVE-2015-20107", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2015-20107" }, { "cve": "CVE-2006-20001", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2006-20001" } ] }
gsd-2022-39253
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-39253", "description": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "id": "GSD-2022-39253", "references": [ "https://alas.aws.amazon.com/cve/html/CVE-2022-39253.html", "https://advisories.mageia.org/CVE-2022-39253.html", "https://www.suse.com/security/cve/CVE-2022-39253.html", "https://ubuntu.com/security/CVE-2022-39253" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-39253" ], "details": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "id": "GSD-2022-39253", "modified": "2023-12-13T01:19:20.624357Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-39253", "STATE": "PUBLIC", "TITLE": "Git subject to exposure of sensitive information via local clone of symbolic links" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "git", "version": { "version_data": [ { "version_value": "\u003c 2.30.6" }, { "version_value": "\u003c 2.31.5" }, { "version_value": "\u003c 2.32.4" }, { "version_value": "\u003c 2.33.5" }, { "version_value": "\u003c 2.34.5" }, { "version_value": "\u003c 2.35.5" }, { "version_value": "\u003c 2.36.3" }, { "version_value": "\u003c 2.37.4" } ] } } ] }, "vendor_name": "git" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85", "refsource": "CONFIRM", "url": "https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85" }, { "name": "FEDORA-2022-12790ca71a", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/" }, { "name": "FEDORA-2022-8b58806840", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/" }, { "name": "https://support.apple.com/kb/HT213496", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT213496" }, { "name": "FEDORA-2022-53aadd995f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/" }, { "name": "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2022/Nov/1" }, { "name": "FEDORA-2022-2c33bba286", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/" }, { "name": "FEDORA-2022-fb088df94c", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/" }, { "name": "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "name": "[oss-security] 20230214 [Announce] Git 2.39.2 and friends", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2023/02/14/5" }, { "name": "GLSA-202312-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202312-15" } ] }, "source": { "advisory": "GHSA-3wp6-j8xr-qw85", "discovery": "UNKNOWN" } }, "nvd.nist.gov": { "cve": { "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "28199E8F-36D0-46F8-AF0A-9460390BE56F", "versionEndExcluding": "2.30.6", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "E095AAE7-18C2-4957-9740-FC804860B9C2", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.31.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "459EE43E-40FB-45BE-A1CC-51435E9F92AD", "versionEndExcluding": "2.32.4", "versionStartIncluding": "2.32.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CBDDA42-F5EC-4747-BF3C-16683D684702", "versionEndExcluding": "2.33.5", "versionStartIncluding": "2.33.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7691E22-145E-4D97-A6E0-6515742781B9", "versionEndExcluding": "2.34.5", "versionStartIncluding": "2.34.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "E02396C2-BB34-4D18-917E-DA56EA7B58B9", "versionEndExcluding": "2.35.5", "versionStartIncluding": "2.35.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "51BEAEEC-9D9D-4CFE-8958-43BFE87DE501", "versionEndExcluding": "2.36.3", "versionStartIncluding": "2.36.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*", "matchCriteriaId": "566CF89C-AC39-47D7-B3DE-633B2237F816", "versionEndExcluding": "2.37.4", "versionStartIncluding": "2.37.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*", "matchCriteriaId": "1AFEECCB-B8DB-4270-A860-C2BA1C7B267C", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true }, { "criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true }, { "criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*", "matchCriteriaId": "CECD39AA-41F4-4638-B59A-C5E928B585C3", "versionEndExcluding": "14.1", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "descriptions": [ { "lang": "en", "value": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`." }, { "lang": "es", "value": "Git es un sistema de control de revisiones distribuido, escalable y de c\u00f3digo abierto. Las versiones anteriores a la 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 est\u00e1n sujetas a una exposici\u00f3n de informaci\u00f3n confidencial a un actor malicioso. Cuando es llevado a cabo un clon local (en el que el origen y el destino del clon est\u00e1n en el mismo volumen), Git copia el contenido del directorio \"$GIT_DIR/objects\" del origen en el destino creando enlaces duros al contenido del origen o copi\u00e1ndolo (si los enlaces duros est\u00e1n deshabilitados por medio de \"--no-hardlinks\"). Un actor malicioso podr\u00eda convencer a una v\u00edctima de clonar un repositorio con un enlace simb\u00f3lico que apunte a informaci\u00f3n confidencial en la m\u00e1quina de la v\u00edctima. Esto puede hacerse ya sea que la v\u00edctima clone un repositorio malicioso en la misma m\u00e1quina, o haciendo que clone un repositorio malicioso insertado como repositorio desnudo por medio de un subm\u00f3dulo de cualquier fuente, siempre que clone con la opci\u00f3n \"--recurse-submodules\". Git no crea enlaces simb\u00f3licos en el directorio \"$GIT_DIR/objects\". El problema ha sido parcheado en las versiones publicadas el 18-10-2022, y retrocedido a v2.30.x. Posibles mitigaciones: Evite clonar repositorios no confiables usando la optimizaci\u00f3n \"--local\" cuando est\u00e9 en una m\u00e1quina compartida, ya sea pasando la opci\u00f3n \"--no-local\" a \"git clone\" o clonando desde una URL que use el esquema \"file://\". Alternativamente, evita clonar repositorios de fuentes no confiables con \"--recurse-submodules\" o ejecuta \"git config --global protocol.file.allow user\"" } ], "id": "CVE-2022-39253", "lastModified": "2023-12-27T10:15:37.640", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary" } ] }, "published": "2022-10-19T11:15:11.227", "references": [ { "source": "security-advisories@github.com", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2022/Nov/1" }, { "source": "security-advisories@github.com", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2023/02/14/5" }, { "source": "security-advisories@github.com", "tags": [ "Mitigation", "Third Party Advisory" ], "url": "https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85" }, { "source": "security-advisories@github.com", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/" }, { "source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/" }, { "source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/" }, { "source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/" }, { "source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/" }, { "source": "security-advisories@github.com", "url": "https://security.gentoo.org/glsa/202312-15" }, { "source": "security-advisories@github.com", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT213496" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-59" } ], "source": "nvd@nist.gov", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-200" } ], "source": "security-advisories@github.com", "type": "Secondary" } ] } } } }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.