rhsa-2023:2859
Vulnerability from csaf_redhat
Published
2023-05-16 08:32
Modified
2024-11-22 21:15
Summary
Red Hat Security Advisory: git security and bug fix update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for git is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:2859", url: "https://access.redhat.com/errata/RHSA-2023:2859", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index", url: "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index", }, { category: "external", summary: "2073414", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2073414", }, { category: "external", summary: "2107439", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2107439", }, { category: "external", summary: "2137422", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2137422", }, { category: "external", summary: "2137423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2137423", }, { category: "external", summary: "2139378", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2139378", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2859.json", }, ], title: "Red Hat Security Advisory: git security and bug fix update", tracking: { current_release_date: "2024-11-22T21:15:36+00:00", generator: { date: "2024-11-22T21:15:36+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2023:2859", initial_release_date: "2023-05-16T08:32:51+00:00", revision_history: [ { date: "2023-05-16T08:32:51+00:00", number: "1", summary: "Initial version", }, { date: "2023-05-16T08:32:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T21:15:36+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "git-0:2.39.1-1.el8.src", product: { name: "git-0:2.39.1-1.el8.src", product_id: "git-0:2.39.1-1.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/git@2.39.1-1.el8?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "git-0:2.39.1-1.el8.aarch64", product: { name: "git-0:2.39.1-1.el8.aarch64", product_id: "git-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-core-0:2.39.1-1.el8.aarch64", product: { name: "git-core-0:2.39.1-1.el8.aarch64", product_id: "git-core-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-credential-libsecret-0:2.39.1-1.el8.aarch64", product: { name: "git-credential-libsecret-0:2.39.1-1.el8.aarch64", product_id: "git-credential-libsecret-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-daemon-0:2.39.1-1.el8.aarch64", product: { name: "git-daemon-0:2.39.1-1.el8.aarch64", product_id: "git-daemon-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-subtree-0:2.39.1-1.el8.aarch64", product: { name: "git-subtree-0:2.39.1-1.el8.aarch64", product_id: "git-subtree-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-debugsource-0:2.39.1-1.el8.aarch64", product: { name: "git-debugsource-0:2.39.1-1.el8.aarch64", product_id: "git-debugsource-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-core-debuginfo-0:2.39.1-1.el8.aarch64", product: { name: "git-core-debuginfo-0:2.39.1-1.el8.aarch64", product_id: "git-core-debuginfo-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", product: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", product_id: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", product: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", product_id: "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=aarch64", }, }, }, { category: "product_version", name: "git-debuginfo-0:2.39.1-1.el8.aarch64", product: { name: "git-debuginfo-0:2.39.1-1.el8.aarch64", product_id: "git-debuginfo-0:2.39.1-1.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "git-0:2.39.1-1.el8.ppc64le", product: { name: "git-0:2.39.1-1.el8.ppc64le", product_id: "git-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-core-0:2.39.1-1.el8.ppc64le", product: { name: "git-core-0:2.39.1-1.el8.ppc64le", product_id: "git-core-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", product: { name: "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", product_id: "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-daemon-0:2.39.1-1.el8.ppc64le", product: { name: "git-daemon-0:2.39.1-1.el8.ppc64le", product_id: "git-daemon-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-subtree-0:2.39.1-1.el8.ppc64le", product: { name: "git-subtree-0:2.39.1-1.el8.ppc64le", product_id: "git-subtree-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-debugsource-0:2.39.1-1.el8.ppc64le", product: { name: "git-debugsource-0:2.39.1-1.el8.ppc64le", product_id: "git-debugsource-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", product: { name: "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", product_id: "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", product: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", product_id: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", product: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", product_id: "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=ppc64le", }, }, }, { category: "product_version", name: "git-debuginfo-0:2.39.1-1.el8.ppc64le", product: { name: "git-debuginfo-0:2.39.1-1.el8.ppc64le", product_id: "git-debuginfo-0:2.39.1-1.el8.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=ppc64le", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "git-0:2.39.1-1.el8.x86_64", product: { name: "git-0:2.39.1-1.el8.x86_64", product_id: "git-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-core-0:2.39.1-1.el8.x86_64", product: { name: "git-core-0:2.39.1-1.el8.x86_64", product_id: "git-core-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-credential-libsecret-0:2.39.1-1.el8.x86_64", product: { name: "git-credential-libsecret-0:2.39.1-1.el8.x86_64", product_id: "git-credential-libsecret-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-daemon-0:2.39.1-1.el8.x86_64", product: { name: "git-daemon-0:2.39.1-1.el8.x86_64", product_id: "git-daemon-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-subtree-0:2.39.1-1.el8.x86_64", product: { name: "git-subtree-0:2.39.1-1.el8.x86_64", product_id: "git-subtree-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-debugsource-0:2.39.1-1.el8.x86_64", product: { name: "git-debugsource-0:2.39.1-1.el8.x86_64", product_id: "git-debugsource-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-core-debuginfo-0:2.39.1-1.el8.x86_64", product: { name: "git-core-debuginfo-0:2.39.1-1.el8.x86_64", product_id: "git-core-debuginfo-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", product: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", product_id: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", product: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", product_id: "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=x86_64", }, }, }, { category: "product_version", name: "git-debuginfo-0:2.39.1-1.el8.x86_64", product: { name: "git-debuginfo-0:2.39.1-1.el8.x86_64", product_id: "git-debuginfo-0:2.39.1-1.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "git-0:2.39.1-1.el8.s390x", product: { name: "git-0:2.39.1-1.el8.s390x", product_id: "git-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-core-0:2.39.1-1.el8.s390x", product: { name: "git-core-0:2.39.1-1.el8.s390x", product_id: "git-core-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-credential-libsecret-0:2.39.1-1.el8.s390x", product: { name: "git-credential-libsecret-0:2.39.1-1.el8.s390x", product_id: "git-credential-libsecret-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-daemon-0:2.39.1-1.el8.s390x", product: { name: "git-daemon-0:2.39.1-1.el8.s390x", product_id: "git-daemon-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-subtree-0:2.39.1-1.el8.s390x", product: { name: "git-subtree-0:2.39.1-1.el8.s390x", product_id: "git-subtree-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-debugsource-0:2.39.1-1.el8.s390x", product: { name: "git-debugsource-0:2.39.1-1.el8.s390x", product_id: "git-debugsource-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-core-debuginfo-0:2.39.1-1.el8.s390x", product: { name: "git-core-debuginfo-0:2.39.1-1.el8.s390x", product_id: "git-core-debuginfo-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", product: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", product_id: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", product: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", product_id: "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=s390x", }, }, }, { category: "product_version", name: "git-debuginfo-0:2.39.1-1.el8.s390x", product: { name: "git-debuginfo-0:2.39.1-1.el8.s390x", product_id: "git-debuginfo-0:2.39.1-1.el8.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "git-all-0:2.39.1-1.el8.noarch", product: { name: "git-all-0:2.39.1-1.el8.noarch", product_id: "git-all-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/git-all@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "git-core-doc-0:2.39.1-1.el8.noarch", product: { name: "git-core-doc-0:2.39.1-1.el8.noarch", product_id: "git-core-doc-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/git-core-doc@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "git-email-0:2.39.1-1.el8.noarch", product: { name: "git-email-0:2.39.1-1.el8.noarch", product_id: "git-email-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/git-email@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "git-gui-0:2.39.1-1.el8.noarch", product: { name: "git-gui-0:2.39.1-1.el8.noarch", product_id: "git-gui-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/git-gui@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "git-instaweb-0:2.39.1-1.el8.noarch", product: { name: "git-instaweb-0:2.39.1-1.el8.noarch", product_id: "git-instaweb-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/git-instaweb@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "git-svn-0:2.39.1-1.el8.noarch", product: { name: "git-svn-0:2.39.1-1.el8.noarch", product_id: "git-svn-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/git-svn@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "gitk-0:2.39.1-1.el8.noarch", product: { name: "gitk-0:2.39.1-1.el8.noarch", product_id: "gitk-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/gitk@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "gitweb-0:2.39.1-1.el8.noarch", product: { name: "gitweb-0:2.39.1-1.el8.noarch", product_id: "gitweb-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/gitweb@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "perl-Git-0:2.39.1-1.el8.noarch", product: { name: "perl-Git-0:2.39.1-1.el8.noarch", product_id: "perl-Git-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Git@2.39.1-1.el8?arch=noarch", }, }, }, { category: "product_version", name: "perl-Git-SVN-0:2.39.1-1.el8.noarch", product: { name: "perl-Git-SVN-0:2.39.1-1.el8.noarch", product_id: "perl-Git-SVN-0:2.39.1-1.el8.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el8?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "git-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", }, product_reference: "git-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", }, product_reference: "git-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-0:2.39.1-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", }, product_reference: "git-0:2.39.1-1.el8.src", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", }, product_reference: "git-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-all-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", }, product_reference: "git-all-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", }, product_reference: "git-core-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-core-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", }, product_reference: "git-core-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", }, product_reference: "git-core-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", }, product_reference: "git-core-debuginfo-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", }, product_reference: "git-core-debuginfo-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", }, product_reference: "git-core-debuginfo-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-core-doc-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", }, product_reference: "git-core-doc-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", }, product_reference: "git-credential-libsecret-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", }, product_reference: "git-credential-libsecret-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", }, product_reference: "git-credential-libsecret-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", }, product_reference: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", }, product_reference: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", }, product_reference: "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", }, product_reference: "git-daemon-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-daemon-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", }, product_reference: "git-daemon-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", }, product_reference: "git-daemon-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", }, product_reference: "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", }, product_reference: "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", }, product_reference: "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", }, product_reference: "git-debuginfo-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-debuginfo-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", }, product_reference: "git-debuginfo-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", }, product_reference: "git-debuginfo-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debugsource-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", }, product_reference: "git-debugsource-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debugsource-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-debugsource-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debugsource-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", }, product_reference: "git-debugsource-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-debugsource-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", }, product_reference: "git-debugsource-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-email-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", }, product_reference: "git-email-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-gui-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", }, product_reference: "git-gui-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-instaweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", }, product_reference: "git-instaweb-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-subtree-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", }, product_reference: "git-subtree-0:2.39.1-1.el8.aarch64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-subtree-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", }, product_reference: "git-subtree-0:2.39.1-1.el8.ppc64le", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-subtree-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", }, product_reference: "git-subtree-0:2.39.1-1.el8.s390x", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-subtree-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", }, product_reference: "git-subtree-0:2.39.1-1.el8.x86_64", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "git-svn-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", }, product_reference: "git-svn-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "gitk-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", }, product_reference: "gitk-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "gitweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", }, product_reference: "gitweb-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "perl-Git-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", }, product_reference: "perl-Git-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, { category: "default_component_of", full_product_name: { name: "perl-Git-SVN-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", }, product_reference: "perl-Git-SVN-0:2.39.1-1.el8.noarch", relates_to_product_reference: "AppStream-8.8.0.GA", }, ], }, vulnerabilities: [ { cve: "CVE-2022-24765", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, discovery_date: "2022-04-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2073414", }, ], notes: [ { category: "description", text: "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", title: "Vulnerability description", }, { category: "summary", text: "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2022-24765", }, { category: "external", summary: "RHBZ#2073414", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2073414", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2022-24765", url: "https://www.cve.org/CVERecord?id=CVE-2022-24765", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", url: "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", }, { category: "external", summary: "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", url: "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", }, ], release_date: "2022-04-12T10:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-05-16T08:32:51+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:2859", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", }, { cve: "CVE-2022-29187", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, discovery_date: "2022-07-15T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2107439", }, ], notes: [ { category: "description", text: "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", title: "Vulnerability description", }, { category: "summary", text: "git: Bypass of safe.directory protections", title: "Vulnerability summary", }, { category: "other", text: "This flaw occurs due to an incomplete fix of CVE-2022-24765.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2022-29187", }, { category: "external", summary: "RHBZ#2107439", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2107439", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2022-29187", url: "https://www.cve.org/CVERecord?id=CVE-2022-29187", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", url: "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", }, ], release_date: "2022-07-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-05-16T08:32:51+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:2859", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "git: Bypass of safe.directory protections", }, { cve: "CVE-2022-39253", cwe: { id: "CWE-59", name: "Improper Link Resolution Before File Access ('Link Following')", }, discovery_date: "2022-10-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2137422", }, ], notes: [ { category: "description", text: "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", title: "Vulnerability description", }, { category: "summary", text: "git: exposure of sensitive information to a malicious actor", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2022-39253", }, { category: "external", summary: "RHBZ#2137422", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2137422", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2022-39253", url: "https://www.cve.org/CVERecord?id=CVE-2022-39253", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", url: "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", }, ], release_date: "2022-10-18T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-05-16T08:32:51+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:2859", }, { category: "workaround", details: "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", product_ids: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "git: exposure of sensitive information to a malicious actor", }, { cve: "CVE-2022-39260", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2022-10-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2137423", }, ], notes: [ { category: "description", text: "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", title: "Vulnerability description", }, { category: "summary", text: "git: git shell function that splits command arguments can lead to arbitrary heap writes.", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2022-39260", }, { category: "external", summary: "RHBZ#2137423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2137423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2022-39260", url: "https://www.cve.org/CVERecord?id=CVE-2022-39260", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", url: "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", }, ], release_date: "2022-10-18T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-05-16T08:32:51+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:2859", }, { category: "workaround", details: "Disabling `git shell` access via remote logins is a viable short-term workaround.", product_ids: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "git: git shell function that splits command arguments can lead to arbitrary heap writes.", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.