[SECURITY] [DLA 3338-1] git security update

2023-02-2317:05:47

lists.debian.org

git

security update

debian 10

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

45.7%

JSON

Debian LTS Advisory DLA-3338-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
February 23, 2023 https://wiki.debian.org/LTS

Package : git
Version : 1:2.20.1-2+deb10u8
CVE ID : CVE-2023-22490 CVE-2023-23946

Several vulnerabilities have been discovered in git, a fast, scalable
and distributed revision control system.

CVE-2023-22490

yvvdwf found a data exfiltration vulnerability while performing a local
clone from a malicious repository even using a non-local transport.

CVE-2023-23946

Joern Schneeweisz found a path traversal vulnerbility in git-apply
that a path outside the working tree can be overwritten as the acting
user.

For Debian 10 buster, these problems have been fixed in version
1:2.20.1-2+deb10u8.

We recommend that you upgrade your git packages.

For the detailed security status of git please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/git

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10arm64git< 1:2.20.1-2+deb10u8git_1:2.20.1-2+deb10u8_arm64.deb
Debian11ppc64elgit-dbgsym< 1:2.30.2-1+deb11u2git-dbgsym_1:2.30.2-1+deb11u2_ppc64el.deb
Debian11allgit< 1:2.30.2-1+deb11u2git_1:2.30.2-1+deb11u2_all.deb
Debian10amd64git< 1:2.20.1-2+deb10u8git_1:2.20.1-2+deb10u8_amd64.deb
Debian10i386git-dbgsym< 1:2.20.1-2+deb10u8git-dbgsym_1:2.20.1-2+deb10u8_i386.deb
Debian11i386git< 1:2.30.2-1+deb11u2git_1:2.30.2-1+deb11u2_i386.deb
Debian11armhfgit< 1:2.30.2-1+deb11u2git_1:2.30.2-1+deb11u2_armhf.deb
Debian11amd64git-dbgsym< 1:2.30.2-1+deb11u2git-dbgsym_1:2.30.2-1+deb11u2_amd64.deb
Debian11allgitweb< 1:2.30.2-1+deb11u2gitweb_1:2.30.2-1+deb11u2_all.deb
Debian10allgit-all< 1:2.20.1-2+deb10u8git-all_1:2.20.1-2+deb10u8_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	arm64	git	< 1:2.20.1-2+deb10u8	git_1:2.20.1-2+deb10u8_arm64.deb
Debian	11	ppc64el	git-dbgsym	< 1:2.30.2-1+deb11u2	git-dbgsym_1:2.30.2-1+deb11u2_ppc64el.deb
Debian	11	all	git	< 1:2.30.2-1+deb11u2	git_1:2.30.2-1+deb11u2_all.deb
Debian	10	amd64	git	< 1:2.20.1-2+deb10u8	git_1:2.20.1-2+deb10u8_amd64.deb
Debian	10	i386	git-dbgsym	< 1:2.20.1-2+deb10u8	git-dbgsym_1:2.20.1-2+deb10u8_i386.deb
Debian	11	i386	git	< 1:2.30.2-1+deb11u2	git_1:2.30.2-1+deb11u2_i386.deb
Debian	11	armhf	git	< 1:2.30.2-1+deb11u2	git_1:2.30.2-1+deb11u2_armhf.deb
Debian	11	amd64	git-dbgsym	< 1:2.30.2-1+deb11u2	git-dbgsym_1:2.30.2-1+deb11u2_amd64.deb
Debian	11	all	gitweb	< 1:2.30.2-1+deb11u2	gitweb_1:2.30.2-1+deb11u2_all.deb
Debian	10	all	git-all	< 1:2.20.1-2+deb10u8	git-all_1:2.20.1-2+deb10u8_all.deb