Lucene search

K
mageiaGentoo FoundationMGASA-2023-0066
HistoryFeb 27, 2023 - 11:27 p.m.

Updated git packages fix security vulnerability

2023-02-2723:27:16
Gentoo Foundation
advisories.mageia.org
48
git
repository
vulnerability
attack
data exfiltration
cve-2022-39253
cve-2023-22490
cve-2023-23946
working tree
filesystem
transport
clones

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

43.4%

Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links, the objects directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim’s filesystem within the malicious repository’s working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253 (CVE-2023-22490). By feeding a crafted input to “git apply”, a path outside the working tree can be overwritten as the user who is running “git apply” (CVE-2023-23946).

OSVersionArchitecturePackageVersionFilename
Mageia8noarchgit< 2.30.8-1git-2.30.8-1.mga8

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

43.4%