Bugzilla – Bug 1204455
VUL-0: CVE-2022-39253: git: dereference issue with symbolic links via the `--local` clone mechanism
Last modified: 2023-02-15 14:33:08 UTC
CVE-2022-39253 Posted by Taylor Blau on Oct 18The Git project released new versions on 2022-10-18, addressing CVEs 2022-39253, 2022-39260. We highly recommend upgrading to one of the fixed versions below: v2.30.6 v2.31.5 v2.32.4 v2.33.5 v2.34.5 v2.35.5 v2.36.3 v2.37.4 v2.38.1 If you are on the unreleased development track, the same fix is already included, so you do not have to do anything. https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u The relevant information from the... CVE-2022-39253: When relying on the `--local` clone optimization, Git dereferences symbolic links in the source repository before creating hardlinks (or copies) of the dereferenced link in the destination repository. This can lead to surprising behavior where arbitrary files are present in a repository's `$GIT_DIR` when cloning from a malicious repository. Git will no longer dereference symbolic links via the `--local` clone mechanism, and will instead refuse to clone repositories that have symbolic links present in the `$GIT_DIR/objects` directory. Additionally, the value of `protocol.file.allow` is changed to be "user" by default. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39253 https://seclists.org/oss-sec/2022/q4/31
Created attachment 862254 [details] Upstream fix for CVE-2022-39253 Commit: 6f054f9fb3a501c35b55c65e547a244f14c38d56
This is an autogenerated message for OBS integration: This bug (1204455) was mentioned in https://build.opensuse.org/request/show/1031390 Factory / git
SUSE-SU-2022:3931-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1204455,1204456 CVE References: CVE-2022-39253,CVE-2022-39260 JIRA References: Sources used: openSUSE Leap 15.4 (src): git-2.35.3-150300.10.18.1 openSUSE Leap 15.3 (src): git-2.35.3-150300.10.18.1 SUSE Linux Enterprise Module for Development Tools 15-SP4 (src): git-2.35.3-150300.10.18.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): git-2.35.3-150300.10.18.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): git-2.35.3-150300.10.18.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): git-2.35.3-150300.10.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Security Team... related to bug 1205372 From https://docs.docker.com/engine/release-notes/#201020 > Builder > > Added a mitigation to the classic Builder and updated BuildKit to v0.8.3-31-gc0149372, for CVE-2022-39253. Please evaluate docker tooling.
SUSE-SU-2022:4271-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1204455,1204456 CVE References: CVE-2022-39253,CVE-2022-39260 JIRA References: Sources used: SUSE OpenStack Cloud 8 (src): git-2.26.2-27.60.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): git-2.26.2-27.60.1 SUSE Linux Enterprise Server 12-SP5 (src): git-2.26.2-27.60.1 HPE Helion Openstack 8 (src): git-2.26.2-27.60.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0418-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1204455,1204456,1208027,1208028 CVE References: CVE-2022-39253,CVE-2022-39260,CVE-2023-22490,CVE-2023-23946 JIRA References: Sources used: openSUSE Leap 15.4 (src): git-2.26.2-150000.47.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): git-2.26.2-150000.47.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): git-2.26.2-150000.47.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): git-2.26.2-150000.47.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): git-2.26.2-150000.47.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): git-2.26.2-150000.47.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): git-2.26.2-150000.47.1 SUSE Enterprise Storage 7 (src): git-2.26.2-150000.47.1 SUSE CaaS Platform 4.0 (src): git-2.26.2-150000.47.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.