RHSA-2024:0407MediumCVSS 8.8

Red Hat Security Advisory: git security update

Published
January 25, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2022-39260 →CVE-2023-22490 →CVE-2023-23946 →CVE-2022-24765 →CVE-2022-29187 →CVE-2022-39253 →

📋 Description

CVE-2022-24765 — git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree CVE-2022-29187 — git: Bypass of safe.directory protections CVE-2022-39253 — git: exposure of sensitive information to a malicious actor CVE-2022-39260 — git: git shell function that splits command arguments can lead to arbitrary heap writes. CVE-2023-22490 — git: data exfiltration with maliciously crafted repository CVE-2023-23946 — git: git apply: a path outside the working tree can be overwritten with crafted input

🎯 Affected products52

  • Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-0:2.31.8-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-all-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-core-doc-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-daemon-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-daemon-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-daemon-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-daemon-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • +22 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`. Workaround: Disabling `git shell` access via remote logins is a viable short-term workaround. Workaround: - Avoid cloning repositories from untrusted sources with --recurse-submodules. - Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update at each layer. Before doing so, inspect each new .gitmodules file to ensure that it does not contain suspicious module URLs. Workaround: Use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

🔗 References (9)