An update of the git package has been released.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-fb088df94c advisory.

    Upstream update including security & bug fixes as well as feature enhancements.

    From the upstream [release     notes](https://github.com/git/git/raw/v2.38.1/Documentation/RelNotes/2.30.6.txt):

    CVE-2022-39253
    --------------

    When relying on the `--local` clone optimization, Git dereferences     symbolic links in the source repository before creating hardlinks     (or copies) of the dereferenced link in the destination repository.
    This can lead to surprising behavior where arbitrary files are     present in a repository's `$GIT_DIR` when cloning from a malicious     repository.

    Git will no longer dereference symbolic links via the `--local`     clone mechanism, and will instead refuse to clone repositories that     have symbolic links present in the `$GIT_DIR/objects` directory.

    Additionally, the value of `protocol.file.allow` is changed to be     user by default.

    CVE-2022-39260
    --------------

    An overly-long command string given to `git shell` can result in     overflow in `split_cmdline()`, leading to arbitrary heap writes and     remote code execution when `git shell` is exposed and the directory     `$HOME/git-shell-commands` exists.

    `git shell` is taught to refuse interactive commands that are     longer than 4MiB in size. `split_cmdline()` is hardened to reject     inputs larger than 2GiB.

    Credits
    -------

    Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The     fix was authored by Taylor Blau, with help from Johannes Schindelin.

    Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub.
    The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2859 advisory.

  - Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users     working on multi-user machines, where untrusted parties have write access to the same hard disk. Those     untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run     supposedly outside a repository while searching for a Git directory. Git would then respect any config in     said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who     installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are     vulnerable: simply creating a new project would already read and respect the config specified in     `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The     problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git`     on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
    Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user     profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. (CVE-2022-24765)

  - Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4,     2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An     unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when     navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a     git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a     patch for this issue. The simplest way to avoid being affected by the exploit described in the example is     to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a     minimum. While a generic workaround is not possible, a system could be hardened from the exploit described     in the example by removing any such repository if it exists already and creating one as root to block any     future attacks. (CVE-2022-29187)

  - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by     either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-     hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing     at sensitive information on the victim's machine. This can be done either by having the victim clone a     malicious repository on the same machine, or having them clone a malicious repository embedded as a bare     repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
    Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in     the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning     untrusted repositories using the `--local` optimization when on a shared machine, either by passing the     `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,     avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global     protocol.file.allow user`. (CVE-2022-39253)

  - Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an `int` to represent the number of entries in the array, allowing a     malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the     resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code     execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell     in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4,     2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
    Disabling `git shell` access via remote logins is a viable short-term workaround. (CVE-2022-39260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-8b58806840 advisory.

    Upstream update including security & bug fixes as well as feature enhancements.

    From the upstream [release     notes](https://github.com/git/git/raw/v2.38.1/Documentation/RelNotes/2.30.6.txt):

    CVE-2022-39253
    --------------

    When relying on the `--local` clone optimization, Git dereferences     symbolic links in the source repository before creating hardlinks     (or copies) of the dereferenced link in the destination repository.
    This can lead to surprising behavior where arbitrary files are     present in a repository's `$GIT_DIR` when cloning from a malicious     repository.

    Git will no longer dereference symbolic links via the `--local`     clone mechanism, and will instead refuse to clone repositories that     have symbolic links present in the `$GIT_DIR/objects` directory.

    Additionally, the value of `protocol.file.allow` is changed to be     user by default.

    CVE-2022-39260
    --------------

    An overly-long command string given to `git shell` can result in     overflow in `split_cmdline()`, leading to arbitrary heap writes and     remote code execution when `git shell` is exposed and the directory     `$HOME/git-shell-commands` exists.

    `git shell` is taught to refuse interactive commands that are     longer than 4MiB in size. `split_cmdline()` is hardened to reject     inputs larger than 2GiB.

    Credits
    -------

    Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The     fix was authored by Taylor Blau, with help from Johannes Schindelin.

    Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub.
    The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2c33bba286 advisory.

    - Update to 20.10.20.
    - Mitigates CVE-2022-39253


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5686-3 advisory.

    USN-5686-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 22.10.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.30.6 / 2.35.5 / 2.38.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-291-01 advisory.

  -              When relying on the `--local` clone optimization, Git dereferences            symbolic links     in the source repository before creating hardlinks            (or copies) of the dereferenced link in the     destination repository.            This can lead to surprising behavior where arbitrary files are     present in a repository's `$GIT_DIR` when cloning from a malicious            repository.             Git     will no longer dereference symbolic links via the `--local`            clone mechanism, and will instead     refuse to clone repositories that            have symbolic links present in the `$GIT_DIR/objects`     directory.             Additionally, the value of `protocol.file.allow` is changed to be            user     by default.                        An overly-long command string given to `git shell` can result in     overflow in `split_cmdline()`, leading to arbitrary heap writes and            remote code execution when     `git shell` is exposed and the directory            `$HOME/git-shell-commands` exists.             `git     shell` is taught to refuse interactive commands that are            longer than 4MiB in size.
    `split_cmdline()` is hardened to reject            inputs larger than 2GiB.            (CVE-2022-39253,     CVE-2022-39260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3931-1 advisory.

  - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by     either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-     hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing     at sensitive information on the victim's machine. This can be done either by having the victim clone a     malicious repository on the same machine, or having them clone a malicious repository embedded as a bare     repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
    Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in     the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning     untrusted repositories using the `--local` optimization when on a shared machine, either by passing the     `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,     avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global     protocol.file.allow user`. (CVE-2022-39253)

  - Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an `int` to represent the number of entries in the array, allowing a     malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the     resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code     execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell     in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4,     2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
    Disabling `git shell` access via remote logins is a viable short-term workaround. (CVE-2022-39260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.38.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1886 advisory.

    Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's /objects directory into the destination by either     creating hardlinks to the source contents, or copying them (if hardlinks are disabled via --no-hardlinks).
    A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive     information on the victim's machine. This can be done either by having the victim clone a malicious     repository on the same machine, or having them clone a malicious repository embedded as a bare repository     via a submodule from any source, provided they clone with the --recurse-submodules option. Git does not     create symbolic links in the /objects directory. The problem has been patched in the versions published on     2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using     the --local optimization when on a shared machine, either by passing the --no-local option to git clone or     cloning from a URL that uses the file:// scheme. Alternatively, avoid cloning repositories from untrusted     sources with --recurse-submodules or run git config --global protocol.file.allow user. (CVE-2022-39253)

    Git is an open source, scalable, distributed revision control system. git shell is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an int to represent the number of entries in the array, allowing a malicious     actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting     array is then passed to execv(), it is possible to leverage this attack to gain remote code execution on a     victim machine. Note that a victim must first allow access to git shell as a login shell in order to be     vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5,     2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling git shell     access via remote logins is a viable short-term workaround. (CVE-2022-39260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by     either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-     hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing     at sensitive information on the victim's machine. This can be done either by having the victim clone a     malicious repository on the same machine, or having them clone a malicious repository embedded as a bare     repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
    Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in     the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning     untrusted repositories using the `--local` optimization when on a shared machine, either by passing the     `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,     avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global     protocol.file.allow user`. (CVE-2022-39253)

  - Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an `int` to represent the number of entries in the array, allowing a     malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the     resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code     execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell     in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4,     2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
    Disabling `git shell` access via remote logins is a viable short-term workaround. (CVE-2022-39260)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5686-4 advisory.

    USN-5686-1 fixed several vulnerabilities in Git. This update provides the corresponding fix for     CVE-2022-39253 on Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2319 advisory.

  - Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users     working on multi-user machines, where untrusted parties have write access to the same hard disk. Those     untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run     supposedly outside a repository while searching for a Git directory. Git would then respect any config in     said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who     installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are     vulnerable: simply creating a new project would already read and respect the config specified in     `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The     problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git`     on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
    Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user     profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. (CVE-2022-24765)

  - Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4,     2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An     unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when     navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a     git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a     patch for this issue. The simplest way to avoid being affected by the exploit described in the example is     to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a     minimum. While a generic workaround is not possible, a system could be hardened from the exploit described     in the example by removing any such repository if it exists already and creating one as root to block any     future attacks. (CVE-2022-29187)

  - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by     either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-     hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing     at sensitive information on the victim's machine. This can be done either by having the victim clone a     malicious repository on the same machine, or having them clone a malicious repository embedded as a bare     repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
    Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in     the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning     untrusted repositories using the `--local` optimization when on a shared machine, either by passing the     `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,     avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global     protocol.file.allow user`. (CVE-2022-39253)

  - Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an `int` to represent the number of entries in the array, allowing a     malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the     resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code     execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell     in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4,     2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
    Disabling `git shell` access via remote logins is a viable short-term workaround. (CVE-2022-39260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
203242	Photon OS 4.0: Git PHSA-2022-4.0-0271	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
211059	Fedora 37 : git (2022-fb088df94c)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
176176	AlmaLinux 8 : git (ALSA-2023:2859)	Nessus	Alma Linux Local Security Checks	2023/5/20	2023/5/20	high
169173	Fedora 36 : git (2022-8b58806840)	Nessus	Fedora Local Security Checks	2022/12/22	2024/11/14	high
211038	Fedora 37 : moby-engine (2022-2c33bba286)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	medium
168011	Ubuntu 22.10 : Git vulnerabilities (USN-5686-3)	Nessus	Ubuntu Local Security Checks	2022/11/21	2024/10/29	high
166228	Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current git Multiple Vulnerabilities (SSA:2022-291-01)	Nessus	Slackware Local Security Checks	2022/10/18	2022/11/29	high
167347	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2022:3931-1)	Nessus	SuSE Local Security Checks	2022/11/13	2023/7/14	high
168442	Amazon Linux 2 : git (ALAS-2022-1886)	Nessus	Amazon Linux Local Security Checks	2022/12/7	2024/12/11	high
172265	EulerOS 2.0 SP5 : git (EulerOS-SA-2023-1502)	Nessus	Huawei Local Security Checks	2023/3/8	2023/3/8	high
169596	EulerOS 2.0 SP9 : git (EulerOS-SA-2023-1123)	Nessus	Huawei Local Security Checks	2023/1/6	2023/1/6	high
173620	Ubuntu 16.04 ESM : Git vulnerability (USN-5686-4)	Nessus	Ubuntu Local Security Checks	2023/3/28	2024/10/29	medium
175650	AlmaLinux 9 : git (ALSA-2023:2319)	Nessus	Alma Linux Local Security Checks	2023/5/14	2023/5/14	high

偵測

搜尋 Plugin

high

high

high

high

medium

high

high

high

high

high

high

medium

high