Bugzilla – Bug 1207032
VUL-0: CVE-2022-23521: git: gitattributes parsing integer overflow
Last modified: 2023-01-31 08:43:45 UTC
Affected: - SUSE:SLE-12:Update/git - SUSE:SLE-15-SP3:Update/git - SUSE:SLE-15:Update/git - openSUSE:Factory/git
Public in oss-sec: The Git project released versions v2.30.7, v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, v2.38.3, and v2.39.1 today. These maintenance releases are to address the security issues identified as CVE-2022-41903 and CVE-2022-23521. The tarballs are found at: https://www.kernel.org/pub/software/scm/git/ The following public repositories all have a copy of the v2.39.1 tag, as well as the tags for older maintenance tracks for v2.30.7, v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, and v2.38.3. url = https://git.kernel.org/pub/scm/git/git url = https://kernel.googlesource.com/pub/scm/git/git url = git://repo.or.cz/alt-git.git url = https://github.com/gitster/git The addressed issues are: * CVE-2022-23521: gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab. An initial fix was authored by Markus Vervier of X41 D-Sec. Credit for finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41 D-Sec. This work was sponsored by OSTIF. The proposed fixes have been polished and extended to cover additional findings by Patrick Steinhardt of GitLab, with help from others on the Git security mailing list.
This is an autogenerated message for OBS integration: This bug (1207032) was mentioned in https://build.opensuse.org/request/show/1059326 Factory / git
SUSE-SU-2023:0110-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1207032,1207033 CVE References: CVE-2022-23521,CVE-2022-41903 JIRA References: Sources used: openSUSE Leap 15.4 (src): git-2.35.3-150300.10.21.1 SUSE Manager Server 4.2 (src): git-2.35.3-150300.10.21.1 SUSE Manager Retail Branch Server 4.2 (src): git-2.35.3-150300.10.21.1 SUSE Manager Proxy 4.2 (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise Server for SAP 15-SP3 (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise Server 15-SP3-LTSS (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise Realtime Extension 15-SP3 (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise Module for Development Tools 15-SP4 (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src): git-2.35.3-150300.10.21.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src): git-2.35.3-150300.10.21.1 SUSE Enterprise Storage 7.1 (src): git-2.35.3-150300.10.21.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0109-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1207032,1207033 CVE References: CVE-2022-23521,CVE-2022-41903 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): git-2.26.2-27.63.2 SUSE OpenStack Cloud 9 (src): git-2.26.2-27.63.2 SUSE OpenStack Cloud 8 (src): git-2.26.2-27.63.2 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): git-2.26.2-27.63.2 SUSE Linux Enterprise Server for SAP 12-SP4 (src): git-2.26.2-27.63.2 SUSE Linux Enterprise Server 12-SP5 (src): git-2.26.2-27.63.2 SUSE Linux Enterprise Server 12-SP4-LTSS (src): git-2.26.2-27.63.2 SUSE Linux Enterprise Server 12-SP2-BCL (src): git-2.26.2-27.63.2 HPE Helion Openstack 8 (src): git-2.26.2-27.63.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0108-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1207032,1207033 CVE References: CVE-2022-23521,CVE-2022-41903 JIRA References: Sources used: openSUSE Leap 15.4 (src): git-2.26.2-150000.44.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): git-2.26.2-150000.44.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): git-2.26.2-150000.44.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): git-2.26.2-150000.44.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): git-2.26.2-150000.44.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): git-2.26.2-150000.44.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): git-2.26.2-150000.44.1 SUSE Enterprise Storage 7 (src): git-2.26.2-150000.44.1 SUSE Enterprise Storage 6 (src): git-2.26.2-150000.44.1 SUSE CaaS Platform 4.0 (src): git-2.26.2-150000.44.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.