Lucene search

K
mageiaGentoo FoundationMGASA-2023-0066
HistoryFeb 27, 2023 - 11:27 p.m.

Updated git packages fix security vulnerability

2023-02-2723:27:16
Gentoo Foundation
advisories.mageia.org
47

0.001 Low

EPSS

Percentile

43.1%

Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links, the objects directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim’s filesystem within the malicious repository’s working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253 (CVE-2023-22490). By feeding a crafted input to “git apply”, a path outside the working tree can be overwritten as the user who is running “git apply” (CVE-2023-23946).

OSVersionArchitecturePackageVersionFilename
Mageia8noarchgit< 2.30.8-1git-2.30.8-1.mga8