Red Hat Security Advisory

RHSA-2023:3246

git security update

Released 2023-05-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) git-2.39.3-1.el8_8, git-all-2.39.3-1.el8_8, git-core-2.39.3-1.el8_8 +12

Fixes 5 records

TI-2023-10933 CVE-2023-25652

"git apply --reject" partially-controlled arbitrary file write

HIGH 71

Git is a revision control system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.51883 Published 2023-04-25 Partial fix · 2.30.9, 2.31.8 +9 CWE-22

TI-2023-13468 CVE-2023-29007

Arbitrary configuration injection via `git submodule deinit`

MEDIUM 45

Git is a revision control system.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.05609 Published 2023-04-25 Partial fix · 2.30.9, 2.31.8 +9 CWE-74

TI-2023-09743 CVE-2023-23946

Git's `git apply` overwriting paths outside the working tree

MEDIUM 41

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01135 Published 2023-02-14 Partial fix · 2.39.2, 2.38.4 +8 CWE-22

TI-2023-08739 CVE-2023-22490

Git vulnerable to local clone-based data exfiltration with non-local transports

LOW 26

Git is a revision control system.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0071 Published 2023-02-14 Partial fix · 2.39.2, 2.38.4 +8 CWE-59

TI-2023-11085 CVE-2023-25815

Git looks for localized messages in the wrong place

LOW 18

In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer.

CVSS 3.1LOW 3.3 Local Low privileges User interaction EPSS 0.00839 Published 2023-04-25 Partial fix · 2.40.1 CWE-134