SUSE SLES12: git / git-arch / git-core / git-cvs / git-daemon / git-doc / etc (SUSE-SU-2022:4271-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4271-1 advisory. - CVE-2022-39260: Fixed overflow in splitcmdline bsc1204456. - CVE-2022-39253: Fixed dereference issue with symbolic links via the...

SUSE-SU-2022:4271-1 Security update for git

This update for git fixes the following issues: - CVE-2022-39260: Fixed overflow in splitcmdline bsc1204456. - CVE-2022-39253: Fixed dereference issue with symbolic links via the --local clone mechanism bsc1204455...

Ian Dunn: Double evaluation in .bash_prompt of dotfiles allows a malicious repository to execute arbitrary commands

Summary Due to the improper usage of the PS1 environment variable in .bashprompt of dotfiles, a malicious repository can execute arbitrary commands when changed the current directory to it. Description The PS1 environment variable of bash supports command substitutions. For example, setting PS1 t...

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

Ubuntu: Security Advisory (USN-5686-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5686-3: Git vulnerabilities

USN-5686-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 22.10. Original advisory details: Cory Snider discovered that Git incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause an unexpected behaviour. CVE-2022-392...

Ubuntu 22.10 : Git vulnerabilities (USN-5686-3)

The remote Ubuntu 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5686-3 advisory. USN-5686-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 22.10. Tenable has extracted the preceding description blo...

AZL-11540 CVE-2022-41901 affecting package tensorflow for versions less than 2.11.0-1

TensorFlow is an open source platform for machine learning. An input sparsematrix that is not a matrix with a shape with rank 0 will trigger a CHECK fail in tf.rawops.SparseMatrixNNZ. We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be included in...

CVE-2022-41887

TensorFlow is an open source platform for machine learning. tf.keras.losses.poisson receives a ypred and ytrue that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched...

CVE-2022-41899

TensorFlow is an open source platform for machine learning. Inputs densefeatures or examplestatedata not of rank 2 will trigger a CHECK fail in SdcaOptimizer. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will...

Ubuntu: Security Advisory (USN-5686-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM : Git vulnerability (USN-5686-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5686-2 advisory. USN-5686-1 fixed several vulnerabilities in Git. This update provides the corresponding fix for CVE-2022-39260 on Ubuntu 16.04 ESM. Tenable has extracted the...

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

USN-5686-2 git vulnerability

USN-5686-1 fixed several vulnerabilities in Git. This update provides the corresponding fix for CVE-2022-39260 on Ubuntu 16.04 ESM. Original advisory details: Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could possibly use this issue to cause a cras...

USN-5686-2: Git vulnerability

USN-5686-1 fixed several vulnerabilities in Git. This update provides the corresponding fix for CVE-2022-39260 on Ubuntu 16.04 ESM. Original advisory details: Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could possibly use this issue to cause a cras...

Gitea Git Fetch Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gitea Git Fetch Remote Code Execution', 'Description' = %q This module exploits Git fetch command in Gitea repository migration process that lead...

Satellite 6.12 Release

An update is available for libdb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rocky Enterprise Software Foundation Satellite is a systems management tool for...

io.jenkins.blueocean:blueocean-config (>=1.2.0-beta-5, <=1.2.4), io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-5, <=1.2.4) +6 more potentially affected by CVE-2022-45380 via org.jenkins-ci.plugins:junit (1.21)

org.jenkins-ci.plugins:junit MAVEN version 1.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - io.jenkins.blueocean:blueocean-config =1.2.0-beta-5, =1.2.0-beta-5, =1.2.0-beta-5, =bn, =1.3.0, =1.179,...

org.apache.camel:camel-example-ssh (>=2.15.0, <=2.15.6), org.apache.camel:camel-example-ssh-security (>=2.15.0, <=2.15.6) +3 more potentially affected by CVE-2022-45047 via org.apache.sshd:sshd-core (0.13.0)

org.apache.sshd:sshd-core MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sshd:sshd-core and may be impacted: - org.apache.camel:camel-example-ssh =2.15.0, =2.15.0, =2.15.0, =2.15.6 - org.apache.sshd:apache-sshd 0.13.0 -...

com.consol.citrus:citrus-ftp (>=2.7.6, <=2.7.9), com.consol.citrus:citrus-ssh (>=2.7, <=2.7.9) +13 more potentially affected by CVE-2022-45047 via org.apache.sshd:sshd-core (1.3.0)

org.apache.sshd:sshd-core MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sshd:sshd-core and may be impacted: - com.consol.citrus:citrus-ftp =2.7.6, =2.7, =1.2.0, =1.1.3, =0.0.7, =0.0.7, =1.1.2, =2.1.0, =2.1.1 Source cves...