An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2022-1765
Final
1.0
1.0
2022-07-22
Initial
2022-07-22
2022-07-22
openEuler SA Tool V1.0
2022-07-22
git security update
An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce,and ClearCase with features like cheap local branching, convenient staging areas, and multiple workflows.
Security Fix(es):
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.(CVE-2022-29187)
An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
git
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1765
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-29187
https://nvd.nist.gov/vuln/detail/CVE-2022-29187
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS
git-debuginfo-2.27.0-8.oe1.aarch64.rpm
git-2.27.0-8.oe1.aarch64.rpm
git-debugsource-2.27.0-8.oe1.aarch64.rpm
git-daemon-2.27.0-8.oe1.aarch64.rpm
git-daemon-2.27.0-8.oe1.aarch64.rpm
git-2.27.0-8.oe1.aarch64.rpm
git-debugsource-2.27.0-8.oe1.aarch64.rpm
git-debuginfo-2.27.0-8.oe1.aarch64.rpm
git-debugsource-2.33.0-3.oe2203.aarch64.rpm
git-daemon-2.33.0-3.oe2203.aarch64.rpm
git-2.33.0-3.oe2203.aarch64.rpm
git-debuginfo-2.33.0-3.oe2203.aarch64.rpm
git-gui-2.27.0-8.oe1.noarch.rpm
gitk-2.27.0-8.oe1.noarch.rpm
perl-Git-SVN-2.27.0-8.oe1.noarch.rpm
git-svn-2.27.0-8.oe1.noarch.rpm
git-web-2.27.0-8.oe1.noarch.rpm
git-email-2.27.0-8.oe1.noarch.rpm
git-help-2.27.0-8.oe1.noarch.rpm
perl-Git-2.27.0-8.oe1.noarch.rpm
perl-Git-SVN-2.27.0-8.oe1.noarch.rpm
perl-Git-2.27.0-8.oe1.noarch.rpm
git-help-2.27.0-8.oe1.noarch.rpm
git-gui-2.27.0-8.oe1.noarch.rpm
gitk-2.27.0-8.oe1.noarch.rpm
git-svn-2.27.0-8.oe1.noarch.rpm
git-email-2.27.0-8.oe1.noarch.rpm
git-web-2.27.0-8.oe1.noarch.rpm
gitk-2.33.0-3.oe2203.noarch.rpm
git-email-2.33.0-3.oe2203.noarch.rpm
git-svn-2.33.0-3.oe2203.noarch.rpm
git-gui-2.33.0-3.oe2203.noarch.rpm
perl-Git-SVN-2.33.0-3.oe2203.noarch.rpm
git-web-2.33.0-3.oe2203.noarch.rpm
perl-Git-2.33.0-3.oe2203.noarch.rpm
git-help-2.33.0-3.oe2203.noarch.rpm
git-2.27.0-8.oe1.src.rpm
git-2.27.0-8.oe1.src.rpm
git-2.33.0-3.oe2203.src.rpm
git-debugsource-2.27.0-8.oe1.x86_64.rpm
git-daemon-2.27.0-8.oe1.x86_64.rpm
git-2.27.0-8.oe1.x86_64.rpm
git-debuginfo-2.27.0-8.oe1.x86_64.rpm
git-debuginfo-2.27.0-8.oe1.x86_64.rpm
git-debugsource-2.27.0-8.oe1.x86_64.rpm
git-2.27.0-8.oe1.x86_64.rpm
git-daemon-2.27.0-8.oe1.x86_64.rpm
git-debugsource-2.33.0-3.oe2203.x86_64.rpm
git-2.33.0-3.oe2203.x86_64.rpm
git-debuginfo-2.33.0-3.oe2203.x86_64.rpm
git-daemon-2.33.0-3.oe2203.x86_64.rpm
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.
2022-07-22
CVE-2022-29187
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS
High
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
git security update
2022-07-22
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1765