Bug 1207033 (CVE-2022-41903) - VUL-0: CVE-2022-41903: git: heap overflow in `git archive` and `git log --format
Summary: VUL-0: CVE-2022-41903: git: heap overflow in `git archive` and `git log --format
Status: RESOLVED FIXED
Alias: CVE-2022-41903
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv3.1:SUSE:CVE-2022-41903:7.8:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-01-11 06:42 UTC by Thomas Leroy
Modified: 2023-01-31 08:43 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 3 Thomas Leroy 2023-01-12 11:47:11 UTC
Affected:
- SUSE:SLE-12:Update/git
- SUSE:SLE-15-SP3:Update/git
- SUSE:SLE-15:Update/git
- openSUSE:Factory/git
Comment 6 Thomas Leroy 2023-01-18 07:34:19 UTC
Public in oss-sec:



The Git project released versions v2.30.7, v2.31.6, v2.32.5,
v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, v2.38.3, and v2.39.1
today.  These maintenance releases are to address the security
issues identified as CVE-2022-41903 and CVE-2022-23521.

The tarballs are found at:

    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the v2.39.1
tag, as well as the tags for older maintenance tracks for v2.30.7,
v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, and
v2.38.3.

  url = https://git.kernel.org/pub/scm/git/git
  url = https://kernel.googlesource.com/pub/scm/git/git
  url = git://repo.or.cz/alt-git.git
  url = https://github.com/gitster/git

The addressed issues are:

 * CVE-2022-41903:

   git log has the ability to display commits using an arbitrary
   format with its --format specifiers. This functionality is also
   exposed to git archive via the export-subst gitattribute.

   When processing the padding operators (e.g., %<(, %<|(, %>(,
   %>>(, or %><( ), an integer overflow can occur in
   pretty.c::format_and_pad_commit() where a size_t is improperly
   stored as an int, and then added as an offset to a subsequent
   memcpy() call.

   This overflow can be triggered directly by a user running a
   command which invokes the commit formatting machinery (e.g., git
   log --format=...). It may also be triggered indirectly through
   git archive via the export-subst mechanism, which expands format
   specifiers inside of files within the repository during a git
   archive.

   This integer overflow can result in arbitrary heap writes, which
   may result in remote code execution.


Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.
An initial fix was authored by Markus Vervier of X41 D-Sec. Credit for
finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41
D-Sec. This work was sponsored by OSTIF.

The proposed fixes have been polished and extended to cover additional
findings by Patrick Steinhardt of GitLab, with help from others on the
Git security mailing list.
Comment 7 OBSbugzilla Bot 2023-01-18 11:05:05 UTC
This is an autogenerated message for OBS integration:
This bug (1207033) was mentioned in
https://build.opensuse.org/request/show/1059326 Factory / git
Comment 8 Swamp Workflow Management 2023-01-20 14:25:45 UTC
SUSE-SU-2023:0110-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1207032,1207033
CVE References: CVE-2022-23521,CVE-2022-41903
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    git-2.35.3-150300.10.21.1
SUSE Manager Server 4.2 (src):    git-2.35.3-150300.10.21.1
SUSE Manager Retail Branch Server 4.2 (src):    git-2.35.3-150300.10.21.1
SUSE Manager Proxy 4.2 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Server for SAP 15-SP3 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Server 15-SP3-LTSS (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Realtime Extension 15-SP3 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src):    git-2.35.3-150300.10.21.1
SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src):    git-2.35.3-150300.10.21.1
SUSE Enterprise Storage 7.1 (src):    git-2.35.3-150300.10.21.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2023-01-20 14:26:56 UTC
SUSE-SU-2023:0109-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1207032,1207033
CVE References: CVE-2022-23521,CVE-2022-41903
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    git-2.26.2-27.63.2
SUSE OpenStack Cloud 9 (src):    git-2.26.2-27.63.2
SUSE OpenStack Cloud 8 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server 12-SP5 (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    git-2.26.2-27.63.2
SUSE Linux Enterprise Server 12-SP2-BCL (src):    git-2.26.2-27.63.2
HPE Helion Openstack 8 (src):    git-2.26.2-27.63.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2023-01-20 14:29:14 UTC
SUSE-SU-2023:0108-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1207032,1207033
CVE References: CVE-2022-23521,CVE-2022-41903
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    git-2.26.2-150000.44.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    git-2.26.2-150000.44.1
SUSE Enterprise Storage 7 (src):    git-2.26.2-150000.44.1
SUSE Enterprise Storage 6 (src):    git-2.26.2-150000.44.1
SUSE CaaS Platform 4.0 (src):    git-2.26.2-150000.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.