The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.
git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ (CVE-2019-1349)
git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support. (CVE-2017-14867)
Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk. (CVE-2017-15298)
GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).
(CVE-2018-1000021)
Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false
), the described attack won’t work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. before cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6. (CVE-2021-21300)
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. (CVE-2021-40330)
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:\.git
, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set GIT_PS1_SHOWDIRTYSTATE
are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in C:\.git\config
. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder .git
on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
Alternatively, define or extend GIT_CEILING_DIRECTORIES
to cover the parent directory of the user profile, e.g. C:\Users
if the user profile is located in C:\Users\my-user-name
. (CVE-2022-24765)
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source’s $GIT_DIR/objects
directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via --no- hardlinks
). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim’s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the --recurse-submodules
option.
Git does not create symbolic links in the $GIT_DIR/objects
directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the --local
optimization when on a shared machine, either by passing the --no-local
option to git clone
or cloning from a URL that uses the file://
scheme. Alternatively, avoid cloning repositories from untrusted sources with --recurse-submodules
or run git config --global protocol.file.allow user
. (CVE-2022-39253)
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects
directory contains symbolic links, the objects
directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim’s filesystem within the malicious repository’s working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with --recurse-submodules
.
Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update
at each layer. Before doing so, inspect each new .gitmodules
file to ensure that it does not contain suspicious module URLs. (CVE-2023-22490)
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply
, a path outside the working tree can be overwritten as the user who is running git apply
. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat
to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
(CVE-2023-23946)
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization.
However, due to a change in MINGW-packages, the gettext()
function’s implicit initialization no longer uses the runtime prefix but uses the hard-coded path C:\mingw64\share\locale
to look for localized messages. And since any authenticated user has the permission to create folders in C:\
(and since C:\mingw64
does not typically exist), it is possible for low-privilege users to place fake messages in that location where git.exe
will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a C:\mingw64
folder and leave it empty. Users who have administrative rights may remove the permission to create folders in C:\
. (CVE-2023-25815)
Note that Nessus has not tested for these issues but has instead relied on the package manager’s report that the package is installed.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory git. The text
# itself is copyright (C) Red Hat, Inc.
##
include('compat.inc');
if (description)
{
script_id(196808);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/13");
script_cve_id(
"CVE-2017-14867",
"CVE-2017-15298",
"CVE-2018-1000021",
"CVE-2019-1349",
"CVE-2021-21300",
"CVE-2021-40330",
"CVE-2022-24765",
"CVE-2022-39253",
"CVE-2022-39260",
"CVE-2023-22490",
"CVE-2023-23946",
"CVE-2023-25815"
);
script_name(english:"RHEL 7 : git (Unpatched Vulnerability)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 7 host is affected by multiple vulnerabilities that will not be patched.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.
- git: Recursive submodule cloning allows using git directory twice with synonymous directory name written
in .git/ (CVE-2019-1349)
- git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
- Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before
2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to
execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable
via git-shell even without CVS support. (CVE-2017-14867)
- Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of
service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of
disk consumption; however, an affected process typically would not survive its attempt to build the data
structure in memory before writing to disk. (CVE-2017-15298)
- GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result
in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via
The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).
(CVE-2018-1000021)
- Git is an open-source distributed revision control system. In affected versions of Git a specially crafted
repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may
cause just-checked out script to be executed while cloning onto a case-insensitive file system such as
NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters
have to be configured for that. Git for Windows configures Git LFS by default, and is therefore
vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a
workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks
false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are
configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning
repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,
2.17.62.17.6. (CVE-2021-21300)
- git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character,
which may result in unexpected cross-protocol requests, as demonstrated by the
git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. (CVE-2021-40330)
- Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users
working on multi-user machines, where untrusted parties have write access to the same hard disk. Those
untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run
supposedly outside a repository while searching for a Git directory. Git would then respect any config in
said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who
installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are
vulnerable: simply creating a new project would already read and respect the config specified in
`C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The
problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git`
on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user
profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. (CVE-2022-24765)
- Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,
2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a
malicious actor. When performing a local clone (where the source and target of the clone are on the same
volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by
either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-
hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing
at sensitive information on the victim's machine. This can be done either by having the victim clone a
malicious repository on the same machine, or having them clone a malicious repository embedded as a bare
repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in
the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning
untrusted repositories using the `--local` optimization when on a shared machine, either by passing the
`--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,
avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global
protocol.file.allow user`. (CVE-2022-39253)
- Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2,
2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its
local clone optimization even when using a non-local transport. Though Git will abort local clones whose
source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a
symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's
filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar
manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5
v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term
workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`.
Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git
submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it
does not contain suspicious module URLs. (CVE-2023-22490)
- Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6,
2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a
path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been
prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6,
v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid
applying one that creates a symbolic link and then creates a file beyond the symbolic link.
(CVE-2023-23946)
- In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a
consequence, Git is expected not to localize messages at all, and skips the gettext initialization.
However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer
uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized
messages. And since any authenticated user has the permission to create folders in `C:\` (and since
`C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in
that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard
to exploit and requires social engineering. For example, a legitimate message at the end of a clone could
be maliciously modified to ask the user to direct their web browser to a malicious website, and the user
might think that the message comes from Git and is legitimate. It does require local write access by the
attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this
issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or
alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may
remove the permission to create folders in `C:\`. (CVE-2023-25815)
Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1349");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2022-39260");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Git LFS Clone Command Exec');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vendor_unpatched", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/28");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var constraints = [
{
'pkgs': [
{'reference':'git', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'git'}
]
}
];
var flag = 0;
foreach var constraint_array ( constraints ) {
var repo_relative_urls = NULL;
var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
foreach var pkg ( constraint_array['pkgs'] ) {
var unpatched_pkg = NULL;
var _release = NULL;
var sp = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var exists_check = NULL;
var cves = NULL;
if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
if (unpatched_pkg &&
_release &&
(!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
}
}
if (flag)
{
var extra = NULL;
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : unpatched_packages_report()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'git');
}
Vendor | Product | Version | CPE |
---|---|---|---|
redhat | enterprise_linux | git | p-cpe:/a:redhat:enterprise_linux:git |
redhat | enterprise_linux | 6 | cpe:/o:redhat:enterprise_linux:6 |
redhat | enterprise_linux | 8 | cpe:/o:redhat:enterprise_linux:8 |
redhat | enterprise_linux | 7 | cpe:/o:redhat:enterprise_linux:7 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14867
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15298
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000021
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1349
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21300
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40330
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22490
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23946
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25815