Correction releases for the distributed version control system Git versions 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 have been published, addressing two vulnerabilities affecting optimizations during local cloning and the 'git apply' command. You can track the release of package updates in distributions on the pages of Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, and FreeBSD. If installing the update is not possible, it is recommended to avoid executing the 'git clone' operation with the '--recurse-submodules' option with untrusted repositories, as well as to refrain from using the 'git apply' and 'git am' commands with unverified code.
- The CVE-2023-22490 vulnerability allows an attacker controlling the contents of the cloned repository to gain access to sensitive data on the user's system. The vulnerability arises from two shortcomings:
The first shortcoming allows local cloning optimizations to be applied when working with specially crafted repositories, even when using transport that interacts with external systems.
The second shortcoming allows the placement of a symbolic link instead of the $GIT_DIR/objects directory, similar to the CVE-2022-39253 vulnerability, which blocked the placement of symbolic links in the $GIT_DIR/objects directory but did not check that the $GIT_DIR/objects directory itself could be a symbolic link.
In local cloning mode, Git moves $GIT_DIR/objects to the target directory, dereferencing symbolic links, which results in the actual files being copied to the target directory that the links point to. Switching to applying local cloning optimizations for non-local transport allows the vulnerability to be exploited when dealing with external repositories (for example, recursively including submodules with the 'git clone --recurse-submodules' command can lead to cloning a malicious repository packaged as a submodule in another repository).
- The CVE-2023-23946 vulnerability allows overwriting file contents outside the working directory by sending specially crafted input to the "git apply" command. For instance, an attack can be executed while processing attacker-prepared patches in "git apply". To prevent patches from creating files outside the working copy, "git apply" blocks processing of patches that attempt to write files using symbolic links. However, this protection can be bypassed by initially creating a symbolic link.
Source: opennet.ru
