Bugzilla – Bug 1196162
VUL-0: CVE-2022-24975: git: The --mirror option leaks secret for deleted content, aka the "GitBleed"
Last modified: 2022-02-18 14:16:43 UTC
rh#2054686 The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/ https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191 References: https://bugzilla.redhat.com/show_bug.cgi?id=2054686 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24975 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24975 https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191 https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
This requires user education and can be fixed by administrators responsible for individual repositories. nothing that can be done, closing as won't fix