Corrective releases of the distributed version control system Git 2.40.1, 2.39.3, 2.38.5, 2.37.7, 2.36.6, 2.35.8, 2.34.8, 2.33.8, 2.32.7, 2.31.8, and 2.30.9 have been published, addressing five vulnerabilities. You can track the release of package updates in distributions on the pages of Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, and FreeBSD. As a workaround to protect against vulnerabilities, it is recommended to avoid executing the command "git apply --reject" when working with unverified external patches and to check the contents of $GIT_DIR/config before running the commands "git submodule deinit", "git config --rename-section", and "git config --remove-section" when working with untrustworthy repositories.
The CVE-2023-29007 vulnerability allows for substitutions in the configuration file $GIT_DIR/config, which can be used to execute code in the system by specifying paths to executable files in the directives core.pager, core.editor, and core.sshCommand. The vulnerability is caused by a logical error where very long configuration values can be processed as the start of a new section during section renaming or deletion operations in the configuration file. In practice, exploiting the vulnerability can be achieved by specifying very long submodule URLs, which get saved in the $GIT_DIR/config file during initialization. These URLs may be interpreted as new settings when attempting to remove them via "git submodule deinit".
The CVE-2023-25652 vulnerability allows for overwriting the contents of files outside the working tree when processing specially crafted patches using the command "git apply --reject". When attempting to execute a malicious patch that tries to write to a file via a symbolic link, the operation will be rejected. In Git 2.39.1, protection against symbolic link manipulation was enhanced by blocking patches that create symbolic links and attempt to write through them. The essence of the vulnerability is that Git did not take into account that a user might execute the command "git apply --reject" to write the rejected parts of a patch as files with the '.rej' extension, and an attacker could exploit this to write content to arbitrary directories, subject to the current access rights.
Additionally, three vulnerabilities have been fixed that only occur on the Windows platform: CVE-2023-29012 (searching for the executable doskey.exe in the working directory of the repository when the 'Git CMD' command is executed, allowing for the execution of one's own code on the user's system), CVE-2023-25815 (buffer overflow when processing specially formatted localization files in gettext), and CVE-2023-29011 (the possibility of replacing the connect.exe file when using SOCKS5).
Source: opennet.ru
