[SECURITY] [DLA 3239-1] git security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3239-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sylvain Beucler
December 13, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : git
Version : 1:2.20.1-2+deb10u5
CVE ID : CVE-2022-24765 CVE-2022-29187 CVE-2022-39253 CVE-2022-39260
Debian Bug : 1014848 1022046
Multiple issues were found in Git, a distributed revision control
system. An attacker may cause other local users into executing
arbitrary commands, leak information from the local filesystem, and
bypass restricted shell.
Note: Due to new security checks, access to repositories owned and
accessed by different local users may now be rejected by Git; in case
changing ownership is not practical, git displays a way to bypass
these checks using the new 'safe.directory' configuration entry.
CVE-2022-24765
Git is not checking the ownership of directories in a local
multi-user system when running commands specified in the local
repository configuration. This allows the owner of the repository
to cause arbitrary commands to be executed by other users who
access the repository.
CVE-2022-29187
An unsuspecting user could still be affected by the issue reported
in CVE-2022-24765, for example when navigating as root into a
shared tmp directory that is owned by them, but where an attacker
could create a git repository.
CVE-2022-39253
Exposure of sensitive information to a malicious actor. When
performing a local clone (where the source and target of the clone
are on the same volume), Git copies the contents of the source's
`$GIT_DIR/objects` directory into the destination by either
creating hardlinks to the source contents, or copying them (if
hardlinks are disabled via `--no-hardlinks`). A malicious actor
could convince a victim to clone a repository with a symbolic link
pointing at sensitive information on the victim's machine.
CVE-2022-39260
`git shell` improperly uses an `int` to represent the number of
entries in the array, allowing a malicious actor to intentionally
overflow the return value, leading to arbitrary heap
writes. Because the resulting array is then passed to `execv()`,
it is possible to leverage this attack to gain remote code
execution on a victim machine.
For Debian 10 buster, these problems have been fixed in version
1:2.20.1-2+deb10u5.
We recommend that you upgrade your git packages.
For the detailed security status of git please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/git
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmOYwhgACgkQDTl9HeUl
XjB+YQ//Z1rbpavYRk7TtXJ4m1hIM3SGlhBQmdGpJ4tpUsaaHqCVXl0ImToteGKc
NEgxS7pg8at03PZGLY51KTPMCPTpqJ2JONS5TKXkhSh5F/X82E3H+CpjvilsfLsH
mNHUMUsIkQAmDp/lDIfVQFNNMTppjTv0Cbwemx9j96kgVpeF8s4zkUR1NBKH0vSG
0xYr8wI5LT/gapOb4azAc4wawditDFicPHQmavdvjNvjOHPAinkpAxNys69HjsaO
JHCykZDtk/UjaVVnDYhiM+0hMucEj7/xJJHux+kGmtpvKX6wLA5D+NFv/Hunwenm
hZO/B1ffpOveynhY3sTVWThsvi9wSxj/qb8behJMy6zfesgipY0TWTWLjyOSwZ7h
6aNMJrxMce2ZeFesGHyMEGTDkD2u6ggLihKWiy0Uvq0ehtxuwfmA1jgwg4gC06l6
52lcC5wM5+zOAaQ4j5M4w1jPAstH4VxtYJfuevQHHL8S7eSg8/MDpP9MH3DvVvkF
Inl9PH3bR+09K4jYmUjKBFDlMAZ33rEFxOzpSCw9MQVFSUWBVF//CCU9G50n/78k
ITv+aQ9Zge3pbaTLCnsBADWveZuDzdtSNj0uqsU4syKos5Q674as+K9a8avSDnX9
VEo9omiowokOrCq9yyIAbeXZpK7GjKj4GxiGd5hjbjK+hq8iB5U=
=yV1A
-----END PGP SIGNATURE-----
Reply to: