152 lines
14 KiB
XML
152 lines
14 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2022-1765</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2022-07-22</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2022-07-22</InitialReleaseDate>
|
|
<CurrentReleaseDate>2022-07-22</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2022-07-22</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">git security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce,and ClearCase with features like cheap local branching, convenient staging areas, and multiple workflows.
|
|
|
|
Security Fix(es):
|
|
|
|
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.(CVE-2022-29187)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for git is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
|
|
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">git</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1765</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-29187</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-29187</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="git-debuginfo-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-debuginfo-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debugsource-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-debugsource-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-daemon-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-daemon-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-daemon-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-daemon-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debugsource-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-debugsource-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debuginfo-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-debuginfo-2.27.0-8.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debugsource-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-debugsource-2.33.0-3.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-daemon-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-daemon-2.33.0-3.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-2.33.0-3.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debuginfo-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-debuginfo-2.33.0-3.oe2203.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="git-gui-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-gui-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="gitk-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gitk-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="perl-Git-SVN-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">perl-Git-SVN-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-svn-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-svn-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-web-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-web-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-email-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-email-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-help-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-help-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="perl-Git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">perl-Git-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="perl-Git-SVN-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">perl-Git-SVN-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="perl-Git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">perl-Git-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-help-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-help-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-gui-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-gui-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="gitk-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">gitk-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-svn-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-svn-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-email-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-email-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-web-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-web-2.27.0-8.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="gitk-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">gitk-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-email-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-email-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-svn-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-svn-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-gui-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-gui-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="perl-Git-SVN-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">perl-Git-SVN-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-web-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-web-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="perl-Git-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">perl-Git-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="git-help-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-help-2.33.0-3.oe2203.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-2.27.0-8.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-2.27.0-8.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-2.33.0-3.oe2203.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="git-debugsource-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-debugsource-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-daemon-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-daemon-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debuginfo-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">git-debuginfo-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debuginfo-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-debuginfo-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debugsource-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-debugsource-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-daemon-2.27.0-8" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">git-daemon-2.27.0-8.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debugsource-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-debugsource-2.33.0-3.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-2.33.0-3.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-debuginfo-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-debuginfo-2.33.0-3.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="git-daemon-2.33.0-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">git-daemon-2.33.0-3.oe2203.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2022-07-22</ReleaseDate>
|
|
<CVE>CVE-2022-29187</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
|
|
<ProductID>openEuler-22.03-LTS</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.8</BaseScore>
|
|
<Vector>AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>git security update</Description>
|
|
<DATE>2022-07-22</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1765</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |