Bug 1207032 - (CVE-2022-23521) VUL-0: CVE-2022-23521: git: gitattributes parsing integer overflow
(CVE-2022-23521)
VUL-0: CVE-2022-23521: git: gitattributes parsing integer overflow
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
CVSSv3.1:SUSE:CVE-2022-23521:7.8:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2023-01-11 06:37 UTC by Thomas Leroy
Modified: 2023-01-31 08:43 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 3 Thomas Leroy 2023-01-12 11:47:04 UTC
Affected:
- SUSE:SLE-12:Update/git
- SUSE:SLE-15-SP3:Update/git
- SUSE:SLE-15:Update/git
- openSUSE:Factory/git
Comment 6 Thomas Leroy 2023-01-18 07:35:07 UTC
Public in oss-sec:



The Git project released versions v2.30.7, v2.31.6, v2.32.5,
v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, v2.38.3, and v2.39.1
today.  These maintenance releases are to address the security
issues identified as CVE-2022-41903 and CVE-2022-23521.

The tarballs are found at:

    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the v2.39.1
tag, as well as the tags for older maintenance tracks for v2.30.7,
v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, and
v2.38.3.

  url = https://git.kernel.org/pub/scm/git/git
  url = https://kernel.googlesource.com/pub/scm/git/git
  url = git://repo.or.cz/alt-git.git
  url = https://github.com/gitster/git

The addressed issues are:

* CVE-2022-23521:

    gitattributes are a mechanism to allow defining attributes for
    paths. These attributes can be defined by adding a `.gitattributes`
    file to the repository, which contains a set of file patterns and
    the attributes that should be set for paths matching this pattern.

    When parsing gitattributes, multiple integer overflows can occur
    when there is a huge number of path patterns, a huge number of
    attributes for a single pattern, or when the declared attribute
    names are huge.

    These overflows can be triggered via a crafted `.gitattributes` file
    that may be part of the commit history. Git silently splits lines
    longer than 2KB when parsing gitattributes from a file, but not when
    parsing them from the index. Consequentially, the failure mode
    depends on whether the file exists in the working tree, the index or
    both.

    This integer overflow can result in arbitrary heap reads and writes,
    which may result in remote code execution.

Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.
An initial fix was authored by Markus Vervier of X41 D-Sec. Credit for
finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41
D-Sec. This work was sponsored by OSTIF.

The proposed fixes have been polished and extended to cover additional
findings by Patrick Steinhardt of GitLab, with help from others on the
Git security mailing list.
Comment 7 OBSbugzilla Bot 2023-01-18 11:05:03 UTC
This is an autogenerated message for OBS integration:
This bug (1207032) was mentioned in
https://build.opensuse.org/request/show/1059326 Factory / git
Comment 8 Swamp Workflow Management 2023-01-20 14:25:41 UTC
SUSE-SU-2023:0110-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1207032,1207033
CVE References: CVE-2022-23521,CVE-2022-41903
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    git-2.35.3-150300.10.21.1
SUSE Manager Server 4.2 (src):    git-2.35.3-150300.10.21.1
SUSE Manager Retail Branch Server 4.2 (src):    git-2.35.3-150300.10.21.1
SUSE Manager Proxy 4.2 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Server for SAP 15-SP3 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Server 15-SP3-LTSS (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Realtime Extension 15-SP3 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src):    git-2.35.3-150300.10.21.1
SUSE Enterprise Storage 7.1 (src):    git-2.35.3-150300.10.21.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2023-01-20 14:26:52 UTC
SUSE-SU-2023:0109-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1207032,1207033
CVE References: CVE-2022-23521,CVE-2022-41903
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    git-2.26.2-27.63.2
SUSE OpenStack Cloud 9 (src):    git-2.26.2-27.63.2
SUSE OpenStack Cloud 8 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server 12-SP5 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server 12-SP2-BCL (src):    git-2.26.2-27.63.2
HPE Helion Openstack 8 (src):    git-2.26.2-27.63.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2023-01-20 14:29:10 UTC
SUSE-SU-2023:0108-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1207032,1207033
CVE References: CVE-2022-23521,CVE-2022-41903
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    git-2.26.2-150000.44.1
SUSE Enterprise Storage 7 (src):    git-2.26.2-150000.44.1
SUSE Enterprise Storage 6 (src):    git-2.26.2-150000.44.1
SUSE CaaS Platform 4.0 (src):    git-2.26.2-150000.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.