Advisories ยป MGASA-2023-0066

Updated git packages fix security vulnerability

Publication date: 27 Feb 2023
Modification date: 27 Feb 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2023-22490 , CVE-2023-23946

Description

Using a specially-crafted repository, Git can be tricked into using its local
clone optimization even when using a non-local transport. Though Git will
abort local clones whose source $GIT_DIR/objects directory contains symbolic
links, the objects directory itself may still be a symbolic link. These two
may be combined to include arbitrary files based on known paths on the
victim's filesystem within the malicious repository's working copy, allowing
for data exfiltration in a similar manner as CVE-2022-39253 (CVE-2023-22490).

By feeding a crafted input to "git apply", a path outside the working tree can
be overwritten as the user who is running "git apply" (CVE-2023-23946).

References

SRPMS

8/core