ROS-20230322-03

A vulnerability in the Git program is related to the input of processed input data - a path outside the working
tree can be overwritten by a user running “git apply”. Exploiting the vulnerability could
allow an attacker acting remotely to run the affected command against a malicious or compromised repository.
compromised repository and overwrite arbitrary files on the system.

A vulnerability in the Git program, related to the insecure handling of symbolic links when using the
local cloning optimization, Git aborts local clones whose source directory is
$GIT_DIR/objects contains symbolic links, but the object directory itself may still be a
symbolic link. Exploiting the vulnerability could allow an attacker acting remotely,
trick the victim into using local cloning optimization to exfiltrate arbitrary files from the victim’s system.
files from the victim’s system.