Ubuntu alert USN-7207-2 (git)

From:
             
 
Marc Deslauriers <marc.deslauriers@canonical.com>
To:
             
 
"ubuntu-security-announce@lists.ubuntu.com" <ubuntu-security-announce@lists.ubuntu.com>
Subject:
             
 
[USN-7207-2] Git vulnerabilities
Date:
             
 
Thu, 27 Feb 2025 13:03:39 -0500
Message-ID:
             
 
<9ee7c490-7fad-46d2-a162-e69bf70aa49b@canonical.com>
==========================================================================
Ubuntu Security Notice USN-7207-2
February 27, 2025

git vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Git.

Software Description:
- git: fast, scalable, distributed revision control system

Details:

USN-7207-1 fixed vulnerabilities in Git. This update provides the
corresponding updates for Ubuntu 20.04 LTS.

Original advisory details:

  It was discovered that Git incorrectly handled certain URLs when
  asking for credentials. An attacker could possibly use this
  issue to mislead the user into typing passwords for trusted
  sites that would then be sent to untrusted sites instead.
  (CVE-2024-50349)
   It was discovered that git incorrectly handled line endings when
  using credential helpers. (CVE-2024-52006)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
   git                             1:2.25.1-1ubuntu3.14

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7207-2
   https://ubuntu.com/security/notices/USN-7207-1
   CVE-2024-50349, CVE-2024-52006

Package Information:
   https://launchpad.net/ubuntu/+source/git/1:2.25.1-1ubuntu...



Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmfAqPwFAwAAAAAACgkQZWnYVadEvpMB
6Q/+OYtuxrr29ZUghYThD+ms6crUSdC+oKVErdvNluiOMeQOJkdZelMqRzF5bYqE9yZmOr0EjUfa
5ISx8tnc5CGbsWz2ufiQT8UzxUrfIxvgyyrIZTMY1YEttiExn4Heduv4tV0WzWuAtBguBEAvxq2e
RmrcjP/ZWftIl+Toljo5VQSAjtQZWk2Vk9h3xhJA/U96Wx48+OPKWE3cD/qK6PzlOqPDvJaEFi7+
7fCFiFdjOTDc/si2Lq2/0d7sY6/CETvjcr0FGeyHSFStvboG+nEmYe7DRyZMZyoWIWtfU5Hjh2lX
BU3fdz3ln6CZApcwva8XamBwcmB2arDYPDEr9AZk2k9EuCBrz+hnpjDGPvjCFkTPaLRuEVwfRsWA
WpaicK1Tzm23ANR8NVCmIouz7CA6VVB/WnCzascsmMH0+xwweTqtb1nXFP5MzzZw9b6MQIGGHqpN
HEOyE0bKFJAkqvAu4mkYcRBZ7bfPGhsA7IA+hoyr5Svj7yWFYx3kxy3x6V+Vh3WBnhDx4U8BVU/8
XOOSxK51JMtQ4Kdi5kdcMUIjxPH1S7ya6/5zEKIlB/yPkkcV3hctH19Q2DAi5fyWBuhFDsxXn//9
aoYZ0unAWb6p/We71bpjvtL+PM5ESMZe1zDqBPX+tuz1++xnuLRvcaknUPP1AZ2lrR+KV+XFRw9U
o4w=
=ZYqu
-----END PGP SIGNATURE-----


Attachment: None (type=text/plain)