Debian alert DLA-3239-2 (git)

From:
             
 
Sylvain Beucler <beuc@beuc.net>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3239-2] git regression update
Date:
             
 
Wed, 14 Dec 2022 19:36:03 +0100
Message-ID:
             
 
<20221214183603.GA519@mail.beuc.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3239-2                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Sylvain Beucler
December 14, 2022                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : git
Version        : 1:2.20.1-2+deb10u6

In rare conditions, the previous git update released as DLA-3239-1
could generate a segmentation fault, which prevented its availability
on armhf architecture. This update addresses this issue. For reference
the original advisory text follows.

Multiple issues were found in Git, a distributed revision control
system. An attacker may cause other local users into executing
arbitrary commands, leak information from the local filesystem, and
bypass restricted shell.

Note: Due to new security checks, access to repositories owned and
accessed by different local users may now be rejected by Git; in case
changing ownership is not practical, git displays a way to bypass
these checks using the new 'safe.directory' configuration entry.

CVE-2022-24765

    Git is not checking the ownership of directories in a local
    multi-user system when running commands specified in the local
    repository configuration.  This allows the owner of the repository
    to cause arbitrary commands to be executed by other users who
    access the repository.

CVE-2022-29187

    An unsuspecting user could still be affected by the issue reported
    in CVE-2022-24765, for example when navigating as root into a
    shared tmp directory that is owned by them, but where an attacker
    could create a git repository.

CVE-2022-39253

    Exposure of sensitive information to a malicious actor. When
    performing a local clone (where the source and target of the clone
    are on the same volume), Git copies the contents of the source's
    `$GIT_DIR/objects` directory into the destination by either
    creating hardlinks to the source contents, or copying them (if
    hardlinks are disabled via `--no-hardlinks`). A malicious actor
    could convince a victim to clone a repository with a symbolic link
    pointing at sensitive information on the victim's machine.

CVE-2022-39260

    `git shell` improperly uses an `int` to represent the number of
    entries in the array, allowing a malicious actor to intentionally
    overflow the return value, leading to arbitrary heap
    writes. Because the resulting array is then passed to `execv()`,
    it is possible to leverage this attack to gain remote code
    execution on a victim machine.

For Debian 10 buster, this problem has been fixed in version
1:2.20.1-2+deb10u6.

We recommend that you upgrade your git packages.

For the detailed security status of git please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/git

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmOaFl0ACgkQDTl9HeUl
XjDohg//RSPK0FMIwOA0Zzdu6Fi9n52saRWsfWvHAiziiId0EeDalnicnuRezrEg
+aAF3mnO06XhhEcEy7sR+GRpwSay5niIwhaO43oOVfGqtkxYrV8+LbbUczXr6qE7
gv0C8TTRs3Bv6DOQPVSnCoAMLWdFcIixQXjSprljSrZ/C9nNYRVhQBhmcqSm6xIO
1uoVXota30FjJxj+RRQQrznj6ZDhck++gXwWZuvHdDBZyiDP8D992K23vRBFN/LX
FKTJ42ZfP5j2lRs2Xc+KJMsljEjNBKD86kW7dCezx1JZPjWvQ0PFZz71AXhy68v3
6Kr20HN6knnJRvnRhfR+Sm1Z7wdyqiddbyFixxM1ZsGJkl7VYPPdUWU0K7viXvqg
b+/2XRY3m+cnkGrpjg70VUscKOgRZSdDrSV5Bxzw9yJRrCZ5B0Tnrugw2ma/9Qg/
K6roIKXPC1q1vMl3m317J6Huhe9Da3O4evuSmEln9GMxyw+L9LUCSHc2swQxVT41
VKoqx9SY7V1iV6bLtjPFGWT3QJeBbQzkYl03X1wFQFvZ/BKeL5qEtUMH+ugl7FqS
TeHkouTkTginyGz59sTvo5mQaFfXIX+aoqc21i5flHN+9WvKmEC+VzMVHLjOc30o
HwnmCXCOZMcajdmhqE8HQL8aUZl2ephHkMfh0DFuXQXVExybRAs=
=6LjC
-----END PGP SIGNATURE-----