git: 945cff6a5672 - main - security/vuxml: Document recent git CVEs
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 21 Feb 2023 11:37:23 UTC
The branch main has been updated by garga:
URL: https://cgit.FreeBSD.org/ports/commit/?id=945cff6a567218c48af80522dcd17c2056186b65
commit 945cff6a567218c48af80522dcd17c2056186b65
Author: Renato Botelho <garga@FreeBSD.org>
AuthorDate: 2023-02-21 11:34:11 +0000
Commit: Renato Botelho <garga@FreeBSD.org>
CommitDate: 2023-02-21 11:37:19 +0000
security/vuxml: Document recent git CVEs
Document CVEs fixed by devel/git 2.39.1 and 2.39.2:
CVE-2022-41903
CVE-2022-23521
CVE-2023-22490
CVE-2023-23946
PR: 269655
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
security/vuxml/vuln/2023.xml | 146 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 146 insertions(+)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index 1e615fedfde9..3d223b5b546b 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,149 @@
+ <vuln vid="21f12de8-b1db-11ed-b0f4-002590f2a714">
+ <topic>git -- "git apply" overwriting paths outside the working tree</topic>
+ <affects>
+ <package>
+ <name>git</name>
+ <range><lt>2.39.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>git team reports:</p>
+ <blockquote cite="https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh">
+ <p>By feeding a crafted input to "git apply", a path outside the
+ working tree can be overwritten as the user who is running "git
+ apply".</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-23946</cvename>
+ <url>https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/#cve-2023-23946</url>
+ </references>
+ <dates>
+ <discovery>2023-02-14</discovery>
+ <entry>2023-02-21</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="9548d6ed-b1da-11ed-b0f4-002590f2a714">
+ <topic>git -- Local clone-based data exfiltration with non-local transports</topic>
+ <affects>
+ <package>
+ <name>git</name>
+ <range><lt>2.39.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>git team reports:</p>
+ <blockquote cite="https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q">
+ <p>Using a specially-crafted repository, Git can be tricked into using
+ its local clone optimization even when using a non-local transport.
+ Though Git will abort local clones whose source $GIT_DIR/objects
+ directory contains symbolic links (c.f., CVE-2022-39253), the objects
+ directory itself may still be a symbolic link.</p>
+
+ <p>These two may be combined to include arbitrary files based on known
+ paths on the victim's filesystem within the malicious repository's
+ working copy, allowing for data exfiltration in a similar manner as
+ CVE-2022-39253.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-22490</cvename>
+ <url>https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/#cve-2023-22490</url>
+ </references>
+ <dates>
+ <discovery>2023-02-14</discovery>
+ <entry>2023-02-21</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="8fafbef4-b1d9-11ed-b0f4-002590f2a714">
+ <topic>git -- gitattributes parsing integer overflow</topic>
+ <affects>
+ <package>
+ <name>git</name>
+ <range><lt>2.39.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>git team reports:</p>
+ <blockquote cite="https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89">
+ <p>gitattributes are used to define unique attributes corresponding
+ to paths in your repository. These attributes are defined by
+ .gitattributes file(s) within your repository.</p>
+
+ <p>The parser used to read these files has multiple integer
+ overflows, which can occur when parsing either a large number
+ of patterns, a large number of attributes, or attributes with
+ overly-long names.</p>
+
+ <p>These overflows may be triggered via a malicious
+ .gitattributes file. However, Git automatically splits lines at
+ 2KB when reading .gitattributes from a file, but not when parsing
+ it from the index. Successfully exploiting this vulnerability
+ depends on the location of the .gitattributes file in question.</p>
+
+ <p>This integer overflow can result in arbitrary heap reads
+ and writes, which may result in remote code execution.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2022-23521</cvename>
+ <url>https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/#cve-2022-23521</url>
+ </references>
+ <dates>
+ <discovery>2023-01-17</discovery>
+ <entry>2023-02-21</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="2fcca7e4-b1d7-11ed-b0f4-002590f2a714">
+ <topic>git -- Heap overflow in `git archive`, `git log --format` leading to RCE</topic>
+ <affects>
+ <package>
+ <name>git</name>
+ <range><lt>2.39.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The git team reports:</p>
+ <blockquote cite="https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq">
+ <p>git log has the ability to display commits using an arbitrary
+ format with its --format specifiers. This functionality is also
+ exposed to git archive via the export-subst gitattribute.</p>
+ <p>When processing the padding operators (e.g., %<(, %<|(,
+ %>(, %>>(, or %><( ), an integer overflow can occur in
+ pretty.c::format_and_pad_commit() where a size_t is improperly
+ stored as an int, and then added as an offset to a subsequent
+ memcpy() call.</p>
+ <p>This overflow can be triggered directly by a user running a
+ command which invokes the commit formatting machinery (e.g., git
+ log --format=...). It may also be triggered indirectly through
+ git archive via the export-subst mechanism, which expands format
+ specifiers inside of files within the repository during a git
+ archive.</p>
+ <p>This integer overflow can result in arbitrary heap writes, which
+ may result in remote code execution.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2022-41903</cvename>
+ <url>https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/#cve-2022-41903</url>
+ </references>
+ <dates>
+ <discovery>2023-01-17</discovery>
+ <entry>2023-02-21</entry>
+ </dates>
+ </vuln>
+
<vuln vid="5048ed45-b0f1-11ed-ab04-9106b1b896dd">
<topic>gitea -- password hash quality</topic>
<affects>