An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2022-1765 Final 1.0 1.0 2022-07-22 Initial 2022-07-22 2022-07-22 openEuler SA Tool V1.0 2022-07-22 git security update An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce,and ClearCase with features like cheap local branching, convenient staging areas, and multiple workflows. Security Fix(es): Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.(CVE-2022-29187) An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High git https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1765 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-29187 https://nvd.nist.gov/vuln/detail/CVE-2022-29187 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS git-debuginfo-2.27.0-8.oe1.aarch64.rpm git-2.27.0-8.oe1.aarch64.rpm git-debugsource-2.27.0-8.oe1.aarch64.rpm git-daemon-2.27.0-8.oe1.aarch64.rpm git-daemon-2.27.0-8.oe1.aarch64.rpm git-2.27.0-8.oe1.aarch64.rpm git-debugsource-2.27.0-8.oe1.aarch64.rpm git-debuginfo-2.27.0-8.oe1.aarch64.rpm git-debugsource-2.33.0-3.oe2203.aarch64.rpm git-daemon-2.33.0-3.oe2203.aarch64.rpm git-2.33.0-3.oe2203.aarch64.rpm git-debuginfo-2.33.0-3.oe2203.aarch64.rpm git-gui-2.27.0-8.oe1.noarch.rpm gitk-2.27.0-8.oe1.noarch.rpm perl-Git-SVN-2.27.0-8.oe1.noarch.rpm git-svn-2.27.0-8.oe1.noarch.rpm git-web-2.27.0-8.oe1.noarch.rpm git-email-2.27.0-8.oe1.noarch.rpm git-help-2.27.0-8.oe1.noarch.rpm perl-Git-2.27.0-8.oe1.noarch.rpm perl-Git-SVN-2.27.0-8.oe1.noarch.rpm perl-Git-2.27.0-8.oe1.noarch.rpm git-help-2.27.0-8.oe1.noarch.rpm git-gui-2.27.0-8.oe1.noarch.rpm gitk-2.27.0-8.oe1.noarch.rpm git-svn-2.27.0-8.oe1.noarch.rpm git-email-2.27.0-8.oe1.noarch.rpm git-web-2.27.0-8.oe1.noarch.rpm gitk-2.33.0-3.oe2203.noarch.rpm git-email-2.33.0-3.oe2203.noarch.rpm git-svn-2.33.0-3.oe2203.noarch.rpm git-gui-2.33.0-3.oe2203.noarch.rpm perl-Git-SVN-2.33.0-3.oe2203.noarch.rpm git-web-2.33.0-3.oe2203.noarch.rpm perl-Git-2.33.0-3.oe2203.noarch.rpm git-help-2.33.0-3.oe2203.noarch.rpm git-2.27.0-8.oe1.src.rpm git-2.27.0-8.oe1.src.rpm git-2.33.0-3.oe2203.src.rpm git-debugsource-2.27.0-8.oe1.x86_64.rpm git-daemon-2.27.0-8.oe1.x86_64.rpm git-2.27.0-8.oe1.x86_64.rpm git-debuginfo-2.27.0-8.oe1.x86_64.rpm git-debuginfo-2.27.0-8.oe1.x86_64.rpm git-debugsource-2.27.0-8.oe1.x86_64.rpm git-2.27.0-8.oe1.x86_64.rpm git-daemon-2.27.0-8.oe1.x86_64.rpm git-debugsource-2.33.0-3.oe2203.x86_64.rpm git-2.33.0-3.oe2203.x86_64.rpm git-debuginfo-2.33.0-3.oe2203.x86_64.rpm git-daemon-2.33.0-3.oe2203.x86_64.rpm Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks. 2022-07-22 CVE-2022-29187 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H git security update 2022-07-22 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1765