Bug 1204455 - (CVE-2022-39253) VUL-0: CVE-2022-39253: git: dereference issue with symbolic links via the `--local` clone mechanism
(CVE-2022-39253)
VUL-0: CVE-2022-39253: git: dereference issue with symbolic links via the `--...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/345616/
:
Depends on:
Blocks: 1205372
  Show dependency treegraph
 
Reported: 2022-10-19 06:39 UTC by Alexander Bergmann
Modified: 2023-02-15 14:33 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
Andreas.Stieger: needinfo? (security-team)


Attachments
Upstream fix for CVE-2022-39253 (8.05 KB, patch)
2022-10-19 07:31 UTC, Alexander Bergmann
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2022-10-19 06:39:38 UTC
CVE-2022-39253

Posted by Taylor Blau on Oct 18The Git project released new versions on 2022-10-18, addressing CVEs
2022-39253, 2022-39260. We highly recommend upgrading to one of the
fixed versions below:

  v2.30.6 v2.31.5 v2.32.4 v2.33.5 v2.34.5 v2.35.5 v2.36.3 v2.37.4 v2.38.1

If you are on the unreleased development track, the same fix is
already included, so you do not have to do anything.

https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u

The relevant information from the...

CVE-2022-39253:
   When relying on the `--local` clone optimization, Git dereferences
   symbolic links in the source repository before creating hardlinks
   (or copies) of the dereferenced link in the destination repository.
   This can lead to surprising behavior where arbitrary files are
   present in a repository's `$GIT_DIR` when cloning from a malicious
   repository.

   Git will no longer dereference symbolic links via the `--local`
   clone mechanism, and will instead refuse to clone repositories that
   have symbolic links present in the `$GIT_DIR/objects` directory.

   Additionally, the value of `protocol.file.allow` is changed to be
   "user" by default.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39253
https://seclists.org/oss-sec/2022/q4/31
Comment 1 Alexander Bergmann 2022-10-19 07:31:30 UTC
Created attachment 862254 [details]
Upstream fix for CVE-2022-39253

Commit: 6f054f9fb3a501c35b55c65e547a244f14c38d56
Comment 6 OBSbugzilla Bot 2022-10-26 20:35:03 UTC
This is an autogenerated message for OBS integration:
This bug (1204455) was mentioned in
https://build.opensuse.org/request/show/1031390 Factory / git
Comment 7 Swamp Workflow Management 2022-11-10 14:29:48 UTC
SUSE-SU-2022:3931-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1204455,1204456
CVE References: CVE-2022-39253,CVE-2022-39260
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    git-2.35.3-150300.10.18.1
openSUSE Leap 15.3 (src):    git-2.35.3-150300.10.18.1
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    git-2.35.3-150300.10.18.1
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    git-2.35.3-150300.10.18.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    git-2.35.3-150300.10.18.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    git-2.35.3-150300.10.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Andreas Stieger 2022-11-13 09:15:27 UTC
Security Team... related to bug 1205372

From https://docs.docker.com/engine/release-notes/#201020

> Builder
> 
> Added a mitigation to the classic Builder and updated BuildKit to v0.8.3-31-gc0149372, for CVE-2022-39253.

Please evaluate docker tooling.
Comment 9 Swamp Workflow Management 2022-11-29 17:33:16 UTC
SUSE-SU-2022:4271-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1204455,1204456
CVE References: CVE-2022-39253,CVE-2022-39260
JIRA References: 
Sources used:
SUSE OpenStack Cloud 8 (src):    git-2.26.2-27.60.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    git-2.26.2-27.60.1
SUSE Linux Enterprise Server 12-SP5 (src):    git-2.26.2-27.60.1
HPE Helion Openstack 8 (src):    git-2.26.2-27.60.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2023-02-15 14:33:08 UTC
SUSE-SU-2023:0418-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1204455,1204456,1208027,1208028
CVE References: CVE-2022-39253,CVE-2022-39260,CVE-2023-22490,CVE-2023-23946
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    git-2.26.2-150000.47.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    git-2.26.2-150000.47.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    git-2.26.2-150000.47.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    git-2.26.2-150000.47.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    git-2.26.2-150000.47.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    git-2.26.2-150000.47.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    git-2.26.2-150000.47.1
SUSE Enterprise Storage 7 (src):    git-2.26.2-150000.47.1
SUSE CaaS Platform 4.0 (src):    git-2.26.2-150000.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.