git-2.39.3-1.el8
エラータID: AXSA:2023-6144:10
以下項目について対処しました。
[Security Fix]
- Git には、リンクの解釈が不適切な問題があるため、ローカルの
攻撃者により、巧妙に細工されたリポジトリを介して、データの
引き出しを可能とする脆弱性が存在します。(CVE-2023-22490)
- Git の git apply コマンドには、パストラバーサルの問題がある
ため、リモートの攻撃者により、細工された入力を介して、作業
ツリーの外部にあるファイルの上書きを可能とする脆弱性が存在
します。(CVE-2023-23946)
- Git の git apply --reject コマンドには、リモートの攻撃者により、
巧妙に細工されたパッチを介して、作業ツリーの外部にある
ファイルの上書きを可能とする脆弱性が存在します。
(CVE-2023-25652)
- Git には、ローカルの攻撃者により、細工されたメッセージ
ファイルを介して、不正なメッセージの表示を可能とする脆弱性
が存在します。(CVE-2023-25815)
- Git の config.c の git_config_copy_or_rename_section_in_file()
関数には、config ファイルのセクションを削除する際にユーザー
の $GIT_DIR_config ファイルに任意の設定を挿入できてしまう
問題があるため、ローカルの攻撃者により、1024 文字を超える
サブモジュールの URL を含むように巧妙に細工した .gitmodules
ファイルを介して、任意のコードの実行を可能とする脆弱性が
存在します。(CVE-2023-29007)
パッケージをアップデートしてください。
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
N/A
SRPMS
- git-2.39.3-1.el8.src.rpm
MD5: 6bb2ba5db4a17d628939144b2bee41f1
SHA-256: a596ec9b3fc5388b20c1cdef8d1b3f8a5b1217278d2b41a650006b7b8822ea1d
Size: 6.92 MB
Asianux Server 8 for x86_64
- git-2.39.3-1.el8.x86_64.rpm
MD5: 5e7617ff09ee491706fa83966e572924
SHA-256: d82cfb4b9abe43a59dedd2dc4dedef52e0bf4945237f00b791ca927a190b88ef
Size: 102.71 kB - git-all-2.39.3-1.el8.noarch.rpm
MD5: 248ae13be46fe34ca11796df6958c9b2
SHA-256: 5b296d89b8597ad878849f5f9eead6362de6432c74c33bf797e066e64990ce92
Size: 47.72 kB - git-core-2.39.3-1.el8.x86_64.rpm
MD5: 7fda9490286864c7d1530c908246031a
SHA-256: 0261e192a7769bcb3e7aa5160f29172c572af2c11c997deebb90fcbfda05f4c3
Size: 10.74 MB - git-core-doc-2.39.3-1.el8.noarch.rpm
MD5: 39449150398f0bf4cc1c2713495acf9f
SHA-256: 469287fb8640bcca52e92e8a5dd036d3fedffac27113901eae427ed6d6146295
Size: 2.98 MB - git-credential-libsecret-2.39.3-1.el8.x86_64.rpm
MD5: 558e53258a5410c5d43cbbbddfa8720b
SHA-256: 787942e2eea47050fb4223562953daa5752c98efa6dbae835144bc1998da49f5
Size: 54.23 kB - git-daemon-2.39.3-1.el8.x86_64.rpm
MD5: 045bd08ea759f88ff9eef64cc2b07972
SHA-256: 7aff3a538d8d5aed3a00f37b4a33ae02f15914a504af948557114459e53b8381
Size: 1.02 MB - git-email-2.39.3-1.el8.noarch.rpm
MD5: ab188c6e8973caaaf5aa211024cbe553
SHA-256: 9bbb3102b19ce6afca367e3413777f1d4b2fa03a4f303be640be7f7dc9601f20
Size: 92.05 kB - git-gui-2.39.3-1.el8.noarch.rpm
MD5: 5b1d53d9ccc32fc4d926acfb97c78421
SHA-256: 9d383438b0835e39c61c1ba925d9869fe057958ecb16955b3163f01cd9848545
Size: 305.86 kB - git-instaweb-2.39.3-1.el8.noarch.rpm
MD5: 5c6d17b700a6002b959d86f4adaa01ed
SHA-256: 21a4790eccf5ad54f0f45b2a75a67adb34d647937b619354bc7cb8607c1452d4
Size: 62.65 kB - gitk-2.39.3-1.el8.noarch.rpm
MD5: ef9504c3a3d9864d6567bd0c4bdfbe36
SHA-256: 514f64dad2bbf430d09af22224fb9d0ee1ee8214c24fc28015ca3d85481c0744
Size: 208.28 kB - git-subtree-2.39.3-1.el8.x86_64.rpm
MD5: 8be3a496545c41a72af8fc6c2e9c23c2
SHA-256: 3e1145f92fdd02f2fcfa82d979d86a735046ebbf53a9b7e05647cf4135478585
Size: 72.35 kB - git-svn-2.39.3-1.el8.noarch.rpm
MD5: 8731abcc822ccc4784bf3ecb08a743e1
SHA-256: e15b0af2402fc9b36e32468eacf2e09993c4f29a86a7a8490e900e16ba93ec19
Size: 110.17 kB - gitweb-2.39.3-1.el8.noarch.rpm
MD5: 3b1deb16efd032e51c544e884683a870
SHA-256: 088c550d84a691b5ce47ae285aa99a09c1a1ae363c3db71114a70bac9f32bdea
Size: 189.36 kB - perl-Git-2.39.3-1.el8.noarch.rpm
MD5: f9ed1f06d8998f40b74e9309ceec7005
SHA-256: d8193b17eeabcdc32a551aa84cabb4ca87baf820292768794fa6e18c0c0700cc
Size: 77.53 kB - perl-Git-SVN-2.39.3-1.el8.noarch.rpm
MD5: 1d09380220c0cf4cd2965da1668b9a2d
SHA-256: 40526d8dfb32146c00ad60d76e65b23853b13c1be50f45cea3f205444f43a205
Size: 94.25 kB