Lucene search

K
mageiaGentoo FoundationMGASA-2023-0163
HistoryMay 06, 2023 - 9:19 p.m.

Updated git packages fix security vulnerability

2023-05-0621:19:07
Gentoo Foundation
advisories.mageia.org
61
git
security vulnerability
path overwrite
arbitrary configuration injection
unix

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

75.0%

By feeding specially crafted input to ‘git apply --reject’, a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch. (CVE-2023-25652). When Git is compiled with runtime prefix support and runs without translated messages, it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages (CVE-2023-25815). When renaming or deleting a section from a configuration file, certain malicious configuration values may be misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection (CVE-2023-29007).

OSVersionArchitecturePackageVersionFilename
Mageia8noarchgit< 2.30.9-1git-2.30.9-1.mga8

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

75.0%