rhsa-2024_0407
Vulnerability from csaf_redhat
Published
2024-01-25 08:01
Modified
2024-09-16 11:47
Summary
Red Hat Security Advisory: git security update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
* git: data exfiltration with maliciously crafted repository (CVE-2023-22490)
* git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\n* git: data exfiltration with maliciously crafted repository (CVE-2023-22490)\n\n* git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:0407",
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2073414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414"
},
{
"category": "external",
"summary": "2107439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439"
},
{
"category": "external",
"summary": "2137422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422"
},
{
"category": "external",
"summary": "2137423",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423"
},
{
"category": "external",
"summary": "2168160",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168160"
},
{
"category": "external",
"summary": "2168161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168161"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0407.json"
}
],
"title": "Red Hat Security Advisory: git security update",
"tracking": {
"current_release_date": "2024-09-16T11:47:05+00:00",
"generator": {
"date": "2024-09-16T11:47:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2024:0407",
"initial_release_date": "2024-01-25T08:01:33+00:00",
"revision_history": [
{
"date": "2024-01-25T08:01:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-01-25T08:01:33+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-16T11:47:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.31.8-1.el8_6.src",
"product": {
"name": "git-0:2.31.8-1.el8_6.src",
"product_id": "git-0:2.31.8-1.el8_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-core-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-core-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-daemon-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-daemon-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-subtree-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-subtree-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-debugsource-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-debugsource-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_id": "git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-core-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-core-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-daemon-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-daemon-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-subtree-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-subtree-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_id": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-core-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-core-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-daemon-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-daemon-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-subtree-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-subtree-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-debugsource-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-debugsource-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_id": "git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-0:2.31.8-1.el8_6.s390x",
"product_id": "git-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-core-0:2.31.8-1.el8_6.s390x",
"product_id": "git-core-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-daemon-0:2.31.8-1.el8_6.s390x",
"product_id": "git-daemon-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-subtree-0:2.31.8-1.el8_6.s390x",
"product_id": "git-subtree-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-debugsource-0:2.31.8-1.el8_6.s390x",
"product_id": "git-debugsource-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.31.8-1.el8_6.s390x",
"product": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_id": "git-debuginfo-0:2.31.8-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "git-all-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "git-all-0:2.31.8-1.el8_6.noarch",
"product_id": "git-all-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-all@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-core-doc-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "git-core-doc-0:2.31.8-1.el8_6.noarch",
"product_id": "git-core-doc-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-doc@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-email-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "git-email-0:2.31.8-1.el8_6.noarch",
"product_id": "git-email-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-email@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-gui-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "git-gui-0:2.31.8-1.el8_6.noarch",
"product_id": "git-gui-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-gui@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-instaweb-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "git-instaweb-0:2.31.8-1.el8_6.noarch",
"product_id": "git-instaweb-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-instaweb@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-svn-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "git-svn-0:2.31.8-1.el8_6.noarch",
"product_id": "git-svn-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-svn@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "gitk-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "gitk-0:2.31.8-1.el8_6.noarch",
"product_id": "gitk-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gitk@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "gitweb-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "gitweb-0:2.31.8-1.el8_6.noarch",
"product_id": "gitweb-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gitweb@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "perl-Git-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "perl-Git-0:2.31.8-1.el8_6.noarch",
"product_id": "perl-Git-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-Git@2.31.8-1.el8_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch",
"product": {
"name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch",
"product_id": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-Git-SVN@2.31.8-1.el8_6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.31.8-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src"
},
"product_reference": "git-0:2.31.8-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-all-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "git-all-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-core-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-core-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-core-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-core-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-doc-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "git-core-doc-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-daemon-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-daemon-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-daemon-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-daemon-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-debuginfo-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-debugsource-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-debugsource-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-debugsource-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-email-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "git-email-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-gui-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "git-gui-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-instaweb-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "git-instaweb-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64"
},
"product_reference": "git-subtree-0:2.31.8-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le"
},
"product_reference": "git-subtree-0:2.31.8-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x"
},
"product_reference": "git-subtree-0:2.31.8-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64"
},
"product_reference": "git-subtree-0:2.31.8-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-svn-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "git-svn-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitk-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "gitk-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitweb-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "gitweb-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-Git-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "perl-Git-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
},
"product_reference": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-24765",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2022-04-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2073414"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-24765"
},
{
"category": "external",
"summary": "RHBZ#2073414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24765"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765"
},
{
"category": "external",
"summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2",
"url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2"
}
],
"release_date": "2022-04-12T10:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree"
},
{
"cve": "CVE-2022-29187",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2022-07-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2107439"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: Bypass of safe.directory protections",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-29187"
},
{
"category": "external",
"summary": "RHBZ#2107439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29187"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187"
}
],
"release_date": "2022-07-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: Bypass of safe.directory protections"
},
{
"cve": "CVE-2022-39253",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2022-10-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2137422"
}
],
"notes": [
{
"category": "description",
"text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: exposure of sensitive information to a malicious actor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-39253"
},
{
"category": "external",
"summary": "RHBZ#2137422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39253"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253"
}
],
"release_date": "2022-10-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
},
{
"category": "workaround",
"details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: exposure of sensitive information to a malicious actor"
},
{
"cve": "CVE-2022-39260",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2022-10-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2137423"
}
],
"notes": [
{
"category": "description",
"text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-39260"
},
{
"category": "external",
"summary": "RHBZ#2137423",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39260"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260"
}
],
"release_date": "2022-10-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
},
{
"category": "workaround",
"details": "Disabling `git shell` access via remote logins is a viable short-term workaround.",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: git shell function that splits command arguments can lead to arbitrary heap writes."
},
{
"cve": "CVE-2023-22490",
"cwe": {
"id": "CWE-402",
"name": "Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)"
},
"discovery_date": "2023-02-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2168160"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links (CVE-2022-39253), the objects directory may still be a symbolic link.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: data exfiltration with maliciously crafted repository",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-22490"
},
{
"category": "external",
"summary": "RHBZ#2168160",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168160"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-22490",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-22490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22490"
},
{
"category": "external",
"summary": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/",
"url": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q",
"url": "https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q"
}
],
"release_date": "2023-02-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
},
{
"category": "workaround",
"details": "- Avoid cloning repositories from untrusted sources with --recurse-submodules.\n- Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update at each layer. Before doing so, inspect each new .gitmodules file to ensure that it does not contain suspicious module URLs.",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: data exfiltration with maliciously crafted repository"
},
{
"cve": "CVE-2023-23946",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2023-02-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2168161"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Git. This security issue occurs when feeding a crafted input to \"git apply.\" A path outside the working tree can be overwritten by the user running \"git apply.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: git apply: a path outside the working tree can be overwritten with crafted input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability marked as Moderate severity and it\u0027s less likely to be exploitable because it requires a specially crafted malicious patch to be applied via git apply, to overwrite files outside the working tree of the user running git apply. This could lead to some compromise of integrity of resources under certain circumstances, however it does not compromise the whole system or gain additional privileges to execute arbitrary code, or allow remote users to cause a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-23946"
},
{
"category": "external",
"summary": "RHBZ#2168161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168161"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-23946",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23946"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23946",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23946"
},
{
"category": "external",
"summary": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/",
"url": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh",
"url": "https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh"
}
],
"release_date": "2023-02-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:0407"
},
{
"category": "workaround",
"details": "Use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.",
"product_ids": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src",
"AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x",
"AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch",
"AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: git apply: a path outside the working tree can be overwritten with crafted input"
}
]
}
Loading...