Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-39260
Vulnerability from cvelistv5
Published
2022-10-19 00:00
Modified
2024-08-03 12:00
Severity ?
EPSS score ?
Summary
Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T12:00:43.573Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6" }, { "name": "FEDORA-2022-8b58806840", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213496" }, { "name": "FEDORA-2022-53aadd995f", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/" }, { "name": "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1", "tags": [ "mailing-list", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2022/Nov/1" }, { "name": "FEDORA-2022-fb088df94c", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/" }, { "name": "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "name": "GLSA-202312-15", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202312-15" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "git", "vendor": "git", "versions": [ { "status": "affected", "version": "\u003c 2.30.6" }, { "status": "affected", "version": "\u003e 2.31.0, \u003c 2.31.5" }, { "status": "affected", "version": "\u003e 2.32.0, \u003c 2.32.4" }, { "status": "affected", "version": "\u003e 2.33.0, \u003c 2.33.5" }, { "status": "affected", "version": "\u003e 2.34.0, \u003c 2.34.5" }, { "status": "affected", "version": "\u003e 2.34.0, \u003c 2.35.5" }, { "status": "affected", "version": "\u003e 2.35.0, \u003c 2.36.3" }, { "status": "affected", "version": "\u003e 2.37.0, \u003c 2.37.4" } ] } ], "descriptions": [ { "lang": "en", "value": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-12-27T10:06:16.422068", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "url": "https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6" }, { "name": "FEDORA-2022-8b58806840", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/" }, { "url": "https://support.apple.com/kb/HT213496" }, { "name": "FEDORA-2022-53aadd995f", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/" }, { "name": "20221107 APPLE-SA-2022-11-01-1 Xcode 14.1", "tags": [ "mailing-list" ], "url": "http://seclists.org/fulldisclosure/2022/Nov/1" }, { "name": "FEDORA-2022-fb088df94c", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/" }, { "name": "[debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "name": "GLSA-202312-15", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202312-15" } ], "source": { "advisory": "GHSA-rjr6-wcq6-83p6", "discovery": "UNKNOWN" }, "title": "Git vulnerable to Remote Code Execution via Heap overflow in `git shell`" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-39260", "datePublished": "2022-10-19T00:00:00", "dateReserved": "2022-09-02T00:00:00", "dateUpdated": "2024-08-03T12:00:43.573Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-39260\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-10-19T12:15:10.160\",\"lastModified\":\"2024-11-21T07:17:54.090\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.\"},{\"lang\":\"es\",\"value\":\"Git es un sistema de control de revisiones distribuido, escalable y de c\u00f3digo abierto. \\\"git shell\\\" es un shell de acceso restringido que puede ser usado para implementar la funcionalidad push/pull de Git por medio de SSH. En versiones anteriores a 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4, la funci\u00f3n que divide los argumentos del comando en un array usa incorrectamente un \\\"int\\\" para representar el n\u00famero de entradas en el array, permitiendo a un actor malicioso desbordar intencionadamente el valor de retorno, conllevando a escrituras arbitrarias en la pila. Dado que la matriz resultante es pasada a \\\"execv()\\\", es posible aprovechar este ataque para obtener la ejecuci\u00f3n de c\u00f3digo remota en una m\u00e1quina v\u00edctima. Tenga en cuenta que una v\u00edctima debe permitir primero el acceso a \\\"git shell\\\" como shell de inicio de sesi\u00f3n para ser vulnerable a este ataque. Este problema est\u00e1 parcheado en versiones 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 y es recomendado a usuarios actualizar a la \u00faltima versi\u00f3n. Deshabilitar el acceso al \\\"git shell\\\" por medio de inicios de sesi\u00f3n remotos es una mitigaci\u00f3n viable a corto plazo\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.30.6\",\"matchCriteriaId\":\"28199E8F-36D0-46F8-AF0A-9460390BE56F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.31.0\",\"versionEndExcluding\":\"2.31.5\",\"matchCriteriaId\":\"E095AAE7-18C2-4957-9740-FC804860B9C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.32.0\",\"versionEndExcluding\":\"2.32.4\",\"matchCriteriaId\":\"459EE43E-40FB-45BE-A1CC-51435E9F92AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.33.0\",\"versionEndExcluding\":\"2.33.5\",\"matchCriteriaId\":\"2CBDDA42-F5EC-4747-BF3C-16683D684702\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.34.0\",\"versionEndExcluding\":\"2.34.5\",\"matchCriteriaId\":\"D7691E22-145E-4D97-A6E0-6515742781B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.35.0\",\"versionEndExcluding\":\"2.35.5\",\"matchCriteriaId\":\"E02396C2-BB34-4D18-917E-DA56EA7B58B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.36.0\",\"versionEndExcluding\":\"2.36.3\",\"matchCriteriaId\":\"51BEAEEC-9D9D-4CFE-8958-43BFE87DE501\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.37.0\",\"versionEndExcluding\":\"2.37.4\",\"matchCriteriaId\":\"566CF89C-AC39-47D7-B3DE-633B2237F816\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AFEECCB-B8DB-4270-A860-C2BA1C7B267C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\",\"matchCriteriaId\":\"CECD39AA-41F4-4638-B59A-C5E928B585C3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2022/Nov/1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://security.gentoo.org/glsa/202312-15\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://support.apple.com/kb/HT213496\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Nov/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202312-15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.apple.com/kb/HT213496\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
wid-sec-w-2023-0561
Vulnerability from csaf_certbund
Published
2023-03-02 23:00
Modified
2023-05-18 22:00
Summary
Xerox FreeFlow Print Server: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0561 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0561.json" }, { "category": "self", "summary": "WID-SEC-2023-0561 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0561" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-007 vom 2023-05-18", "url": "https://security.business.xerox.com/wp-content/uploads/2023/05/Xerox-Security-Bulletin-XRX23-007-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-005 vom 2023-04-04", "url": "https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-002 vom 2023-03-23", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-002-FreeFlow-Print-Server-v2_Windows10.pdf" }, { "category": "external", "summary": "Xerox Mini Bulletin XRX21A vom 2023-03-02", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-001-FreeFlow%C2%AE-Print-Server-v7.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-05-18T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:46:07.359+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-0561", "initial_release_date": "2023-03-02T23:00:00.000+00:00", "revision_history": [ { "date": "2023-03-02T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-03-22T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-04-03T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server 7", "product": { "name": "Xerox FreeFlow Print Server 7", "product_id": "T000872", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:7" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server 9", "product": { "name": "Xerox FreeFlow Print Server 9", "product_id": "T002977", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:9" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server v2", "product": { "name": "Xerox FreeFlow Print Server v2", "product_id": "T014888", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v2" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-21900", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21900" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21835", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21835" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21830" }, { "cve": "CVE-2022-46882", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46882" }, { "cve": "CVE-2022-46881", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46881" }, { "cve": "CVE-2022-46880", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46880" }, { "cve": "CVE-2022-46878", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46878" }, { "cve": "CVE-2022-46875", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46875" }, { "cve": "CVE-2022-46874", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46874" }, { "cve": "CVE-2022-46872", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46872" }, { "cve": "CVE-2022-45421", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45421" }, { "cve": "CVE-2022-45420", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45420" }, { "cve": "CVE-2022-45419", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45419" }, { "cve": "CVE-2022-45418", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45418" }, { "cve": "CVE-2022-45417", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45417" }, { "cve": "CVE-2022-45416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45416" }, { "cve": "CVE-2022-45415", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45415" }, { "cve": "CVE-2022-45414", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45414" }, { "cve": "CVE-2022-45413", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45413" }, { "cve": "CVE-2022-45412", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45412" }, { "cve": "CVE-2022-45411", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45411" }, { "cve": "CVE-2022-45410", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45410" }, { "cve": "CVE-2022-45409", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45409" }, { "cve": "CVE-2022-45408", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45408" }, { "cve": "CVE-2022-45407", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45407" }, { "cve": "CVE-2022-45406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45406" }, { "cve": "CVE-2022-45405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45405" }, { "cve": "CVE-2022-45404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45404" }, { "cve": "CVE-2022-45403", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45403" }, { "cve": "CVE-2022-45063", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45063" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-44638", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-44638" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-43548" }, { "cve": "CVE-2022-42932", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42932" }, { "cve": "CVE-2022-42929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42929" }, { "cve": "CVE-2022-42928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42928" }, { "cve": "CVE-2022-42927", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42927" }, { "cve": "CVE-2022-42252", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42252" }, { "cve": "CVE-2022-41556", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-41556" }, { "cve": "CVE-2022-41323", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-41323" }, { "cve": "CVE-2022-40962", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40962" }, { "cve": "CVE-2022-40960", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40960" }, { "cve": "CVE-2022-40959", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40959" }, { "cve": "CVE-2022-40958", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40958" }, { "cve": "CVE-2022-40957", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40957" }, { "cve": "CVE-2022-40956", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40956" }, { "cve": "CVE-2022-40674", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40674" }, { "cve": "CVE-2022-3970", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3970" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-39260" }, { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-3786", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3786" }, { "cve": "CVE-2022-37797", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-37797" }, { "cve": "CVE-2022-37454", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-37454" }, { "cve": "CVE-2022-37436", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-37436" }, { "cve": "CVE-2022-36760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-36760" }, { "cve": "CVE-2022-3627", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3627" }, { "cve": "CVE-2022-3626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3626" }, { "cve": "CVE-2022-36087", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-36087" }, { "cve": "CVE-2022-36059", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-36059" }, { "cve": "CVE-2022-3602", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3602" }, { "cve": "CVE-2022-3599", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3599" }, { "cve": "CVE-2022-3598", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3598" }, { "cve": "CVE-2022-3597", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3597" }, { "cve": "CVE-2022-3570", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3570" }, { "cve": "CVE-2022-35256", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-35256" }, { "cve": "CVE-2022-35255", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-35255" }, { "cve": "CVE-2022-34526", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-34526" }, { "cve": "CVE-2022-3276", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3276" }, { "cve": "CVE-2022-32222", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32222" }, { "cve": "CVE-2022-32215", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32215" }, { "cve": "CVE-2022-32213", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32213" }, { "cve": "CVE-2022-32212", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32212" }, { "cve": "CVE-2022-3204", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3204" }, { "cve": "CVE-2022-3190", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3190" }, { "cve": "CVE-2022-31630", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-31630" }, { "cve": "CVE-2022-31629", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-31629" }, { "cve": "CVE-2022-31628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-31628" }, { "cve": "CVE-2022-3155", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3155" }, { "cve": "CVE-2022-3034", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3034" }, { "cve": "CVE-2022-3033", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3033" }, { "cve": "CVE-2022-3032", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3032" }, { "cve": "CVE-2022-29458", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-29458" }, { "cve": "CVE-2022-29187", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-29187" }, { "cve": "CVE-2022-29154", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-29154" }, { "cve": "CVE-2022-2869", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2869" }, { "cve": "CVE-2022-2868", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2868" }, { "cve": "CVE-2022-2867", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2867" }, { "cve": "CVE-2022-27406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-27406" }, { "cve": "CVE-2022-27405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-27405" }, { "cve": "CVE-2022-27404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-27404" }, { "cve": "CVE-2022-26981", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-26981" }, { "cve": "CVE-2022-24765", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-24765" }, { "cve": "CVE-2022-24070", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-24070" }, { "cve": "CVE-2022-23901", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-23901" }, { "cve": "CVE-2022-22844", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-22844" }, { "cve": "CVE-2022-2210", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2210" }, { "cve": "CVE-2022-2208", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2208" }, { "cve": "CVE-2022-2207", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2207" }, { "cve": "CVE-2022-2206", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2206" }, { "cve": "CVE-2022-2183", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2183" }, { "cve": "CVE-2022-2175", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2175" }, { "cve": "CVE-2022-21658", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21658" }, { "cve": "CVE-2022-21628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21628" }, { "cve": "CVE-2022-21626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21626" }, { "cve": "CVE-2022-21624", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21624" }, { "cve": "CVE-2022-21619", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21619" }, { "cve": "CVE-2022-2125", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2125" }, { "cve": "CVE-2022-2122", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2122" }, { "cve": "CVE-2022-2058", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2058" }, { "cve": "CVE-2022-2057", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2057" }, { "cve": "CVE-2022-2056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2056" }, { "cve": "CVE-2022-1925", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1925" }, { "cve": "CVE-2022-1924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1924" }, { "cve": "CVE-2022-1923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1923" }, { "cve": "CVE-2022-1922", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1922" }, { "cve": "CVE-2022-1921", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1921" }, { "cve": "CVE-2022-1920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1920" }, { "cve": "CVE-2022-1348", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1348" }, { "cve": "CVE-2022-1056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1056" }, { "cve": "CVE-2022-0924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0924" }, { "cve": "CVE-2022-0909", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0909" }, { "cve": "CVE-2022-0908", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0908" }, { "cve": "CVE-2022-0907", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0907" }, { "cve": "CVE-2022-0891", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0891" }, { "cve": "CVE-2022-0865", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0865" }, { "cve": "CVE-2022-0562", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0562" }, { "cve": "CVE-2022-0561", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0561" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-46848" }, { "cve": "CVE-2021-46823", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-46823" }, { "cve": "CVE-2021-42694", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-42694" }, { "cve": "CVE-2021-42574", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-42574" }, { "cve": "CVE-2021-37750", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-37750" }, { "cve": "CVE-2021-28544", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-28544" }, { "cve": "CVE-2020-10735", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2020-10735" }, { "cve": "CVE-2019-6111", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2019-6111" }, { "cve": "CVE-2018-7160", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2018-7160" }, { "cve": "CVE-2015-20107", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2015-20107" }, { "cve": "CVE-2006-20001", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2006-20001" } ] }
WID-SEC-W-2023-0561
Vulnerability from csaf_certbund
Published
2023-03-02 23:00
Modified
2023-05-18 22:00
Summary
Xerox FreeFlow Print Server: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0561 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0561.json" }, { "category": "self", "summary": "WID-SEC-2023-0561 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0561" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-007 vom 2023-05-18", "url": "https://security.business.xerox.com/wp-content/uploads/2023/05/Xerox-Security-Bulletin-XRX23-007-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-005 vom 2023-04-04", "url": "https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-002 vom 2023-03-23", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-002-FreeFlow-Print-Server-v2_Windows10.pdf" }, { "category": "external", "summary": "Xerox Mini Bulletin XRX21A vom 2023-03-02", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-001-FreeFlow%C2%AE-Print-Server-v7.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-05-18T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:46:07.359+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-0561", "initial_release_date": "2023-03-02T23:00:00.000+00:00", "revision_history": [ { "date": "2023-03-02T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-03-22T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-04-03T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server 7", "product": { "name": "Xerox FreeFlow Print Server 7", "product_id": "T000872", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:7" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server 9", "product": { "name": "Xerox FreeFlow Print Server 9", "product_id": "T002977", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:9" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server v2", "product": { "name": "Xerox FreeFlow Print Server v2", "product_id": "T014888", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v2" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-21900", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21900" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21835", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21835" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2023-21830" }, { "cve": "CVE-2022-46882", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46882" }, { "cve": "CVE-2022-46881", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46881" }, { "cve": "CVE-2022-46880", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46880" }, { "cve": "CVE-2022-46878", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46878" }, { "cve": "CVE-2022-46875", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46875" }, { "cve": "CVE-2022-46874", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46874" }, { "cve": "CVE-2022-46872", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-46872" }, { "cve": "CVE-2022-45421", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45421" }, { "cve": "CVE-2022-45420", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45420" }, { "cve": "CVE-2022-45419", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45419" }, { "cve": "CVE-2022-45418", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45418" }, { "cve": "CVE-2022-45417", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45417" }, { "cve": "CVE-2022-45416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45416" }, { "cve": "CVE-2022-45415", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45415" }, { "cve": "CVE-2022-45414", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45414" }, { "cve": "CVE-2022-45413", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45413" }, { "cve": "CVE-2022-45412", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45412" }, { "cve": "CVE-2022-45411", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45411" }, { "cve": "CVE-2022-45410", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45410" }, { "cve": "CVE-2022-45409", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45409" }, { "cve": "CVE-2022-45408", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45408" }, { "cve": "CVE-2022-45407", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45407" }, { "cve": "CVE-2022-45406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45406" }, { "cve": "CVE-2022-45405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45405" }, { "cve": "CVE-2022-45404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45404" }, { "cve": "CVE-2022-45403", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45403" }, { "cve": "CVE-2022-45063", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45063" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-44638", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-44638" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-43548" }, { "cve": "CVE-2022-42932", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42932" }, { "cve": "CVE-2022-42929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42929" }, { "cve": "CVE-2022-42928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42928" }, { "cve": "CVE-2022-42927", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42927" }, { "cve": "CVE-2022-42252", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-42252" }, { "cve": "CVE-2022-41556", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-41556" }, { "cve": "CVE-2022-41323", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-41323" }, { "cve": "CVE-2022-40962", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40962" }, { "cve": "CVE-2022-40960", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40960" }, { "cve": "CVE-2022-40959", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40959" }, { "cve": "CVE-2022-40958", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40958" }, { "cve": "CVE-2022-40957", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40957" }, { "cve": "CVE-2022-40956", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40956" }, { "cve": "CVE-2022-40674", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-40674" }, { "cve": "CVE-2022-3970", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3970" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-39260" }, { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-3786", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3786" }, { "cve": "CVE-2022-37797", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-37797" }, { "cve": "CVE-2022-37454", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-37454" }, { "cve": "CVE-2022-37436", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-37436" }, { "cve": "CVE-2022-36760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-36760" }, { "cve": "CVE-2022-3627", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3627" }, { "cve": "CVE-2022-3626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3626" }, { "cve": "CVE-2022-36087", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-36087" }, { "cve": "CVE-2022-36059", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-36059" }, { "cve": "CVE-2022-3602", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3602" }, { "cve": "CVE-2022-3599", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3599" }, { "cve": "CVE-2022-3598", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3598" }, { "cve": "CVE-2022-3597", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3597" }, { "cve": "CVE-2022-3570", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3570" }, { "cve": "CVE-2022-35256", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-35256" }, { "cve": "CVE-2022-35255", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-35255" }, { "cve": "CVE-2022-34526", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-34526" }, { "cve": "CVE-2022-3276", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3276" }, { "cve": "CVE-2022-32222", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32222" }, { "cve": "CVE-2022-32215", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32215" }, { "cve": "CVE-2022-32213", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32213" }, { "cve": "CVE-2022-32212", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-32212" }, { "cve": "CVE-2022-3204", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3204" }, { "cve": "CVE-2022-3190", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3190" }, { "cve": "CVE-2022-31630", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-31630" }, { "cve": "CVE-2022-31629", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-31629" }, { "cve": "CVE-2022-31628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-31628" }, { "cve": "CVE-2022-3155", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3155" }, { "cve": "CVE-2022-3034", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3034" }, { "cve": "CVE-2022-3033", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3033" }, { "cve": "CVE-2022-3032", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-3032" }, { "cve": "CVE-2022-29458", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-29458" }, { "cve": "CVE-2022-29187", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-29187" }, { "cve": "CVE-2022-29154", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-29154" }, { "cve": "CVE-2022-2869", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2869" }, { "cve": "CVE-2022-2868", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2868" }, { "cve": "CVE-2022-2867", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2867" }, { "cve": "CVE-2022-27406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-27406" }, { "cve": "CVE-2022-27405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-27405" }, { "cve": "CVE-2022-27404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-27404" }, { "cve": "CVE-2022-26981", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-26981" }, { "cve": "CVE-2022-24765", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-24765" }, { "cve": "CVE-2022-24070", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-24070" }, { "cve": "CVE-2022-23901", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-23901" }, { "cve": "CVE-2022-22844", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-22844" }, { "cve": "CVE-2022-2210", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2210" }, { "cve": "CVE-2022-2208", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2208" }, { "cve": "CVE-2022-2207", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2207" }, { "cve": "CVE-2022-2206", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2206" }, { "cve": "CVE-2022-2183", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2183" }, { "cve": "CVE-2022-2175", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2175" }, { "cve": "CVE-2022-21658", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21658" }, { "cve": "CVE-2022-21628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21628" }, { "cve": "CVE-2022-21626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21626" }, { "cve": "CVE-2022-21624", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21624" }, { "cve": "CVE-2022-21619", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-21619" }, { "cve": "CVE-2022-2125", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2125" }, { "cve": "CVE-2022-2122", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2122" }, { "cve": "CVE-2022-2058", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2058" }, { "cve": "CVE-2022-2057", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2057" }, { "cve": "CVE-2022-2056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-2056" }, { "cve": "CVE-2022-1925", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1925" }, { "cve": "CVE-2022-1924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1924" }, { "cve": "CVE-2022-1923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1923" }, { "cve": "CVE-2022-1922", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1922" }, { "cve": "CVE-2022-1921", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1921" }, { "cve": "CVE-2022-1920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1920" }, { "cve": "CVE-2022-1348", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1348" }, { "cve": "CVE-2022-1056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-1056" }, { "cve": "CVE-2022-0924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0924" }, { "cve": "CVE-2022-0909", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0909" }, { "cve": "CVE-2022-0908", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0908" }, { "cve": "CVE-2022-0907", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0907" }, { "cve": "CVE-2022-0891", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0891" }, { "cve": "CVE-2022-0865", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0865" }, { "cve": "CVE-2022-0562", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0562" }, { "cve": "CVE-2022-0561", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2022-0561" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-46848" }, { "cve": "CVE-2021-46823", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-46823" }, { "cve": "CVE-2021-42694", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-42694" }, { "cve": "CVE-2021-42574", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-42574" }, { "cve": "CVE-2021-37750", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-37750" }, { "cve": "CVE-2021-28544", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2021-28544" }, { "cve": "CVE-2020-10735", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2020-10735" }, { "cve": "CVE-2019-6111", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2019-6111" }, { "cve": "CVE-2018-7160", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2018-7160" }, { "cve": "CVE-2015-20107", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2015-20107" }, { "cve": "CVE-2006-20001", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00.000+00:00", "title": "CVE-2006-20001" } ] }
wid-sec-w-2022-1790
Vulnerability from csaf_certbund
Published
2022-10-18 22:00
Modified
2024-05-30 22:00
Summary
git: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Git ist eine freie Software zur verteilten Versionsverwaltung von Dateien.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in git ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Git ist eine freie Software zur verteilten Versionsverwaltung von Dateien.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in git ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Code auszuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-1790 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1790.json" }, { "category": "self", "summary": "WID-SEC-2022-1790 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1790" }, { "category": "external", "summary": "OSS Seclist.org Vulnerability Description vom 2022-10-18", "url": "https://seclists.org/oss-sec/2022/q4/31" }, { "category": "external", "summary": "Apple Security Advisory HT213496 vom 2022-11-01", "url": "https://support.apple.com/kb/HT213496" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:3931-1 vom 2022-11-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012868.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-2 vom 2022-11-17", "url": "https://ubuntu.com/security/notices/USN-5686-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-3 vom 2022-11-21", "url": "https://ubuntu.com/security/notices/USN-5686-3" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4271-1 vom 2022-11-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013141.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1886 vom 2022-12-07", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1886.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1653 vom 2022-12-10", "url": "https://alas.aws.amazon.com/ALAS-2022-1653.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-254 vom 2022-12-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-254.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-3239 vom 2022-12-13", "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5332 vom 2023-01-29", "url": "https://lists.debian.org/debian-security-announce/2023/msg00022.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0418-1 vom 2023-02-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013768.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2-2023-1984 vom 2023-03-07", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1984.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1700 vom 2023-03-07", "url": "https://alas.aws.amazon.com/ALAS-2023-1700.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0407 vom 2024-01-25", "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-4 vom 2023-03-28", "url": "https://ubuntu.com/security/notices/USN-5686-4" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2319 vom 2023-05-09", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2859 vom 2023-05-16", "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "external", "summary": "Dell Security Advisory DSA-2023-069 vom 2023-07-21", "url": "https://www.dell.com/support/kbdoc/de-de/000210964/dsa-2023-069-dell-networker-vproxy-security-update-for-multiple-vulnerabilities-detected-on-vproxy-4-3-0-38" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202312-15 vom 2023-12-27", "url": "https://security.gentoo.org/glsa/202312-15" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-2548 vom 2024-05-30", "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2548.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-1939 vom 2024-05-30", "url": "https://alas.aws.amazon.com/ALAS-2024-1939.html" } ], "source_lang": "en-US", "title": "git: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-30T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:36:48.312+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2022-1790", "initial_release_date": "2022-10-18T22:00:00.000+00:00", "revision_history": [ { "date": "2022-10-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-10-19T22:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2022-53AADD995F, FEDORA-2022-8B58806840" }, { "date": "2022-10-20T22:00:00.000+00:00", "number": "3", "summary": "Referenz(en) aufgenommen: FEDORA-2022-2C33BBA286" }, { "date": "2022-11-01T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Apple aufgenommen" }, { "date": "2022-11-10T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-11-17T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-11-21T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-11-29T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-06T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-11T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-13T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-01-29T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-02-15T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-03-06T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-07T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-28T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-05-09T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-16T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-23T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2023-12-27T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2024-01-25T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-30T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Amazon aufgenommen" } ], "status": "final", "version": "22" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c14.1", "product": { "name": "Apple Xcode \u003c14.1", "product_id": "T025171" } } ], "category": "product_name", "name": "Xcode" } ], "category": "vendor", "name": "Apple" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vProxy \u003c4.3.0-40", "product": { "name": "Dell NetWorker vProxy \u003c4.3.0-40", "product_id": "T028847" } } ], "category": "product_name", "name": "NetWorker" } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c2.30.6", "product": { "name": "Open Source git \u003c2.30.6", "product_id": "T025037" } }, { "category": "product_version_range", "name": "\u003c2.31.5", "product": { "name": "Open Source git \u003c2.31.5", "product_id": "T025038" } }, { "category": "product_version_range", "name": "\u003c2.32.4", "product": { "name": "Open Source git \u003c2.32.4", "product_id": "T025039" } }, { "category": "product_version_range", "name": "\u003c2.33.5", "product": { "name": "Open Source git \u003c2.33.5", "product_id": "T025040" } }, { "category": "product_version_range", "name": "\u003c2.34.5", "product": { "name": "Open Source git \u003c2.34.5", "product_id": "T025041" } }, { "category": "product_version_range", "name": "\u003c2.35.5", "product": { "name": "Open Source git \u003c2.35.5", "product_id": "T025042" } }, { "category": "product_version_range", "name": "\u003c2.36.3", "product": { "name": "Open Source git \u003c2.36.3", "product_id": "T025043" } }, { "category": "product_version_range", "name": "\u003c2.37.4", "product": { "name": "Open Source git \u003c2.37.4", "product_id": "T025044" } }, { "category": "product_version_range", "name": "\u003c2.38.1", "product": { "name": "Open Source git \u003c2.38.1", "product_id": "T025045" } } ], "category": "product_name", "name": "git" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in git. Der Fehler besteht aufgrund eines \u00fcberraschenden Verhaltens, wenn beliebige Dateien im \"$GIT_DIR\" eines Repositorys vorhanden sind und von einem b\u00f6sartigen Repository geklont wird. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T025171", "2951", "T002207", "67646", "T000126", "T028847", "398363", "T012167" ] }, "release_date": "2022-10-18T22:00:00.000+00:00", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in git. Der Fehler besteht, wenn eine zu lange Befehlszeichenfolge an die Git-Shell \u00fcbergeben wird. Dies kann zu einem \u00dcberlauf in der Funktion \"split_cmdline()\" f\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen." } ], "product_status": { "known_affected": [ "T025171", "2951", "T002207", "67646", "T000126", "T028847", "398363", "T012167" ] }, "release_date": "2022-10-18T22:00:00.000+00:00", "title": "CVE-2022-39260" } ] }
WID-SEC-W-2022-1790
Vulnerability from csaf_certbund
Published
2022-10-18 22:00
Modified
2024-05-30 22:00
Summary
git: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Git ist eine freie Software zur verteilten Versionsverwaltung von Dateien.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in git ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Git ist eine freie Software zur verteilten Versionsverwaltung von Dateien.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in git ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Code auszuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-1790 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1790.json" }, { "category": "self", "summary": "WID-SEC-2022-1790 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1790" }, { "category": "external", "summary": "OSS Seclist.org Vulnerability Description vom 2022-10-18", "url": "https://seclists.org/oss-sec/2022/q4/31" }, { "category": "external", "summary": "Apple Security Advisory HT213496 vom 2022-11-01", "url": "https://support.apple.com/kb/HT213496" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:3931-1 vom 2022-11-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012868.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-2 vom 2022-11-17", "url": "https://ubuntu.com/security/notices/USN-5686-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-3 vom 2022-11-21", "url": "https://ubuntu.com/security/notices/USN-5686-3" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4271-1 vom 2022-11-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013141.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1886 vom 2022-12-07", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1886.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1653 vom 2022-12-10", "url": "https://alas.aws.amazon.com/ALAS-2022-1653.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-254 vom 2022-12-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-254.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-3239 vom 2022-12-13", "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5332 vom 2023-01-29", "url": "https://lists.debian.org/debian-security-announce/2023/msg00022.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0418-1 vom 2023-02-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013768.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2-2023-1984 vom 2023-03-07", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1984.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1700 vom 2023-03-07", "url": "https://alas.aws.amazon.com/ALAS-2023-1700.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0407 vom 2024-01-25", "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5686-4 vom 2023-03-28", "url": "https://ubuntu.com/security/notices/USN-5686-4" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2319 vom 2023-05-09", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2859 vom 2023-05-16", "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "external", "summary": "Dell Security Advisory DSA-2023-069 vom 2023-07-21", "url": "https://www.dell.com/support/kbdoc/de-de/000210964/dsa-2023-069-dell-networker-vproxy-security-update-for-multiple-vulnerabilities-detected-on-vproxy-4-3-0-38" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202312-15 vom 2023-12-27", "url": "https://security.gentoo.org/glsa/202312-15" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-2548 vom 2024-05-30", "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2548.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-1939 vom 2024-05-30", "url": "https://alas.aws.amazon.com/ALAS-2024-1939.html" } ], "source_lang": "en-US", "title": "git: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-30T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:36:48.312+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2022-1790", "initial_release_date": "2022-10-18T22:00:00.000+00:00", "revision_history": [ { "date": "2022-10-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-10-19T22:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2022-53AADD995F, FEDORA-2022-8B58806840" }, { "date": "2022-10-20T22:00:00.000+00:00", "number": "3", "summary": "Referenz(en) aufgenommen: FEDORA-2022-2C33BBA286" }, { "date": "2022-11-01T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Apple aufgenommen" }, { "date": "2022-11-10T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-11-17T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-11-21T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-11-29T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-06T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-11T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-13T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-01-29T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-02-15T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-03-06T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-07T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-28T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-05-09T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-16T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-23T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2023-12-27T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2024-01-25T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-30T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Amazon aufgenommen" } ], "status": "final", "version": "22" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c14.1", "product": { "name": "Apple Xcode \u003c14.1", "product_id": "T025171" } } ], "category": "product_name", "name": "Xcode" } ], "category": "vendor", "name": "Apple" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vProxy \u003c4.3.0-40", "product": { "name": "Dell NetWorker vProxy \u003c4.3.0-40", "product_id": "T028847" } } ], "category": "product_name", "name": "NetWorker" } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c2.30.6", "product": { "name": "Open Source git \u003c2.30.6", "product_id": "T025037" } }, { "category": "product_version_range", "name": "\u003c2.31.5", "product": { "name": "Open Source git \u003c2.31.5", "product_id": "T025038" } }, { "category": "product_version_range", "name": "\u003c2.32.4", "product": { "name": "Open Source git \u003c2.32.4", "product_id": "T025039" } }, { "category": "product_version_range", "name": "\u003c2.33.5", "product": { "name": "Open Source git \u003c2.33.5", "product_id": "T025040" } }, { "category": "product_version_range", "name": "\u003c2.34.5", "product": { "name": "Open Source git \u003c2.34.5", "product_id": "T025041" } }, { "category": "product_version_range", "name": "\u003c2.35.5", "product": { "name": "Open Source git \u003c2.35.5", "product_id": "T025042" } }, { "category": "product_version_range", "name": "\u003c2.36.3", "product": { "name": "Open Source git \u003c2.36.3", "product_id": "T025043" } }, { "category": "product_version_range", "name": "\u003c2.37.4", "product": { "name": "Open Source git \u003c2.37.4", "product_id": "T025044" } }, { "category": "product_version_range", "name": "\u003c2.38.1", "product": { "name": "Open Source git \u003c2.38.1", "product_id": "T025045" } } ], "category": "product_name", "name": "git" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in git. Der Fehler besteht aufgrund eines \u00fcberraschenden Verhaltens, wenn beliebige Dateien im \"$GIT_DIR\" eines Repositorys vorhanden sind und von einem b\u00f6sartigen Repository geklont wird. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T025171", "2951", "T002207", "67646", "T000126", "T028847", "398363", "T012167" ] }, "release_date": "2022-10-18T22:00:00.000+00:00", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in git. Der Fehler besteht, wenn eine zu lange Befehlszeichenfolge an die Git-Shell \u00fcbergeben wird. Dies kann zu einem \u00dcberlauf in der Funktion \"split_cmdline()\" f\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen." } ], "product_status": { "known_affected": [ "T025171", "2951", "T002207", "67646", "T000126", "T028847", "398363", "T012167" ] }, "release_date": "2022-10-18T22:00:00.000+00:00", "title": "CVE-2022-39260" } ] }
rhsa-2023:2859
Vulnerability from csaf_redhat
Published
2023-05-16 08:32
Modified
2024-11-22 21:15
Summary
Red Hat Security Advisory: git security and bug fix update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2859", "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139378" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2859.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-22T21:15:36+00:00", "generator": { "date": "2024-11-22T21:15:36+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2859", "initial_release_date": "2023-05-16T08:32:51+00:00", "revision_history": [ { "date": "2023-05-16T08:32:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-16T08:32:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:15:36+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.src", "product": { "name": "git-0:2.39.1-1.el8.src", "product_id": "git-0:2.39.1-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.aarch64", "product": { "name": "git-0:2.39.1-1.el8.aarch64", "product_id": "git-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.aarch64", "product": { "name": "git-core-0:2.39.1-1.el8.aarch64", "product_id": "git-core-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el8.aarch64", "product_id": "git-daemon-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el8.aarch64", "product_id": "git-subtree-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el8.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-0:2.39.1-1.el8.ppc64le", "product_id": "git-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el8.ppc64le", "product_id": "git-core-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el8.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el8.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.x86_64", "product": { "name": "git-0:2.39.1-1.el8.x86_64", "product_id": "git-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.x86_64", "product": { "name": "git-core-0:2.39.1-1.el8.x86_64", "product_id": "git-core-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el8.x86_64", "product_id": "git-daemon-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el8.x86_64", "product_id": "git-subtree-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el8.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.s390x", "product": { "name": "git-0:2.39.1-1.el8.s390x", "product_id": "git-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.s390x", "product": { "name": "git-core-0:2.39.1-1.el8.s390x", "product_id": "git-core-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el8.s390x", "product_id": "git-daemon-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el8.s390x", "product_id": "git-subtree-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el8.s390x", "product_id": "git-debugsource-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el8.noarch", "product": { "name": "git-all-0:2.39.1-1.el8.noarch", "product_id": "git-all-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el8.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el8.noarch", "product_id": "git-core-doc-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el8.noarch", "product": { "name": "git-email-0:2.39.1-1.el8.noarch", "product_id": "git-email-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el8.noarch", "product": { "name": "git-gui-0:2.39.1-1.el8.noarch", "product_id": "git-gui-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el8.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el8.noarch", "product_id": "git-instaweb-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el8.noarch", "product": { "name": "git-svn-0:2.39.1-1.el8.noarch", "product_id": "git-svn-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el8.noarch", "product": { "name": "gitk-0:2.39.1-1.el8.noarch", "product_id": "gitk-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el8.noarch", "product": { "name": "gitweb-0:2.39.1-1.el8.noarch", "product_id": "gitweb-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el8.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el8.noarch", "product_id": "perl-Git-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x" }, "product_reference": "git-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src" }, "product_reference": "git-0:2.39.1-1.el8.src", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch" }, "product_reference": "git-all-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x" }, "product_reference": "git-core-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch" }, "product_reference": "git-email-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch" }, "product_reference": "gitk-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." } ] }
rhsa-2023:2319
Vulnerability from csaf_redhat
Published
2023-05-09 10:03
Modified
2024-11-22 21:15
Summary
Red Hat Security Advisory: git security and bug fix update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2319", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2319.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-22T21:15:27+00:00", "generator": { "date": "2024-11-22T21:15:27+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2319", "initial_release_date": "2023-05-09T10:03:04+00:00", "revision_history": [ { "date": "2023-05-09T10:03:04+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-09T10:03:04+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:15:27+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.src", "product": { "name": "git-0:2.39.1-1.el9.src", "product_id": "git-0:2.39.1-1.el9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.aarch64", "product": { "name": "git-0:2.39.1-1.el9.aarch64", "product_id": "git-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-0:2.39.1-1.el9.aarch64", "product_id": "git-core-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product_id": "git-subtree-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-0:2.39.1-1.el9.ppc64le", "product_id": "git-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.x86_64", "product": { "name": "git-0:2.39.1-1.el9.x86_64", "product_id": "git-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-0:2.39.1-1.el9.x86_64", "product_id": "git-core-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product_id": "git-subtree-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.s390x", "product": { "name": "git-0:2.39.1-1.el9.s390x", "product_id": "git-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-0:2.39.1-1.el9.s390x", "product_id": "git-core-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el9.s390x", "product_id": "git-subtree-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product_id": "git-debugsource-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el9.noarch", "product": { "name": "git-all-0:2.39.1-1.el9.noarch", "product_id": "git-all-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product_id": "git-core-doc-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el9.noarch", "product": { "name": "git-email-0:2.39.1-1.el9.noarch", "product_id": "git-email-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el9.noarch", "product": { "name": "git-gui-0:2.39.1-1.el9.noarch", "product_id": "git-gui-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product_id": "git-instaweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el9.noarch", "product": { "name": "git-svn-0:2.39.1-1.el9.noarch", "product_id": "git-svn-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el9.noarch", "product": { "name": "gitk-0:2.39.1-1.el9.noarch", "product_id": "gitk-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el9.noarch", "product": { "name": "gitweb-0:2.39.1-1.el9.noarch", "product_id": "gitweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x" }, "product_reference": "git-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src" }, "product_reference": "git-0:2.39.1-1.el9.src", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch" }, "product_reference": "git-all-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch" }, "product_reference": "git-email-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch" }, "product_reference": "gitk-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." } ] }
rhsa-2023_2319
Vulnerability from csaf_redhat
Published
2023-05-09 10:03
Modified
2024-11-22 21:15
Summary
Red Hat Security Advisory: git security and bug fix update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2319", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2319.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-22T21:15:27+00:00", "generator": { "date": "2024-11-22T21:15:27+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2319", "initial_release_date": "2023-05-09T10:03:04+00:00", "revision_history": [ { "date": "2023-05-09T10:03:04+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-09T10:03:04+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:15:27+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.src", "product": { "name": "git-0:2.39.1-1.el9.src", "product_id": "git-0:2.39.1-1.el9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.aarch64", "product": { "name": "git-0:2.39.1-1.el9.aarch64", "product_id": "git-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-0:2.39.1-1.el9.aarch64", "product_id": "git-core-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product_id": "git-subtree-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-0:2.39.1-1.el9.ppc64le", "product_id": "git-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.x86_64", "product": { "name": "git-0:2.39.1-1.el9.x86_64", "product_id": "git-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-0:2.39.1-1.el9.x86_64", "product_id": "git-core-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product_id": "git-subtree-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.s390x", "product": { "name": "git-0:2.39.1-1.el9.s390x", "product_id": "git-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-0:2.39.1-1.el9.s390x", "product_id": "git-core-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el9.s390x", "product_id": "git-subtree-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product_id": "git-debugsource-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el9.noarch", "product": { "name": "git-all-0:2.39.1-1.el9.noarch", "product_id": "git-all-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product_id": "git-core-doc-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el9.noarch", "product": { "name": "git-email-0:2.39.1-1.el9.noarch", "product_id": "git-email-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el9.noarch", "product": { "name": "git-gui-0:2.39.1-1.el9.noarch", "product_id": "git-gui-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product_id": "git-instaweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el9.noarch", "product": { "name": "git-svn-0:2.39.1-1.el9.noarch", "product_id": "git-svn-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el9.noarch", "product": { "name": "gitk-0:2.39.1-1.el9.noarch", "product_id": "gitk-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el9.noarch", "product": { "name": "gitweb-0:2.39.1-1.el9.noarch", "product_id": "gitweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x" }, "product_reference": "git-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src" }, "product_reference": "git-0:2.39.1-1.el9.src", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch" }, "product_reference": "git-all-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch" }, "product_reference": "git-email-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch" }, "product_reference": "gitk-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." } ] }
rhsa-2024:0407
Vulnerability from csaf_redhat
Published
2024-01-25 08:01
Modified
2024-11-22 23:03
Summary
Red Hat Security Advisory: git security update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
* git: data exfiltration with maliciously crafted repository (CVE-2023-22490)
* git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\n* git: data exfiltration with maliciously crafted repository (CVE-2023-22490)\n\n* git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:0407", "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2168160", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168160" }, { "category": "external", "summary": "2168161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168161" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0407.json" } ], "title": "Red Hat Security Advisory: git security update", "tracking": { "current_release_date": "2024-11-22T23:03:18+00:00", "generator": { "date": "2024-11-22T23:03:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2024:0407", "initial_release_date": "2024-01-25T08:01:33+00:00", "revision_history": [ { "date": "2024-01-25T08:01:33+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-01-25T08:01:33+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T23:03:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.src", "product": { "name": "git-0:2.31.8-1.el8_6.src", "product_id": "git-0:2.31.8-1.el8_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-0:2.31.8-1.el8_6.aarch64", "product_id": "git-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-core-0:2.31.8-1.el8_6.aarch64", "product_id": "git-core-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.aarch64", "product_id": "git-daemon-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.aarch64", "product_id": "git-subtree-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "product_id": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-core-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-core-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-0:2.31.8-1.el8_6.x86_64", "product_id": "git-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-core-0:2.31.8-1.el8_6.x86_64", "product_id": "git-core-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.x86_64", "product_id": "git-daemon-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.x86_64", "product_id": "git-subtree-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "product_id": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-0:2.31.8-1.el8_6.s390x", "product_id": "git-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-core-0:2.31.8-1.el8_6.s390x", "product_id": "git-core-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "product_id": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-daemon-0:2.31.8-1.el8_6.s390x", "product_id": "git-daemon-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-subtree-0:2.31.8-1.el8_6.s390x", "product_id": "git-subtree-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-debugsource-0:2.31.8-1.el8_6.s390x", "product_id": "git-debugsource-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.31.8-1.el8_6?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "product": { "name": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "product_id": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.31.8-1.el8_6?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-all-0:2.31.8-1.el8_6.noarch", "product_id": "git-all-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-core-doc-0:2.31.8-1.el8_6.noarch", "product_id": "git-core-doc-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-email-0:2.31.8-1.el8_6.noarch", "product_id": "git-email-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-gui-0:2.31.8-1.el8_6.noarch", "product_id": "git-gui-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-instaweb-0:2.31.8-1.el8_6.noarch", "product_id": "git-instaweb-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.31.8-1.el8_6.noarch", "product": { "name": "git-svn-0:2.31.8-1.el8_6.noarch", "product_id": "git-svn-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.31.8-1.el8_6.noarch", "product": { "name": "gitk-0:2.31.8-1.el8_6.noarch", "product_id": "gitk-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.31.8-1.el8_6.noarch", "product": { "name": "gitweb-0:2.31.8-1.el8_6.noarch", "product_id": "gitweb-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.31.8-1.el8_6.noarch", "product": { "name": "perl-Git-0:2.31.8-1.el8_6.noarch", "product_id": "perl-Git-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.31.8-1.el8_6?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "product": { "name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "product_id": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.31.8-1.el8_6?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src" }, "product_reference": "git-0:2.31.8-1.el8_6.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-all-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-core-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-core-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-core-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-core-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-core-doc-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-daemon-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-debuginfo-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-debugsource-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-email-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-gui-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-instaweb-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.31.8-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64" }, "product_reference": "git-subtree-0:2.31.8-1.el8_6.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch" }, "product_reference": "git-svn-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch" }, "product_reference": "gitk-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch" }, "product_reference": "gitweb-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch" }, "product_reference": "perl-Git-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" }, "product_reference": "perl-Git-SVN-0:2.31.8-1.el8_6.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." }, { "cve": "CVE-2023-22490", "cwe": { "id": "CWE-402", "name": "Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)" }, "discovery_date": "2023-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168160" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links (CVE-2022-39253), the objects directory may still be a symbolic link.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: data exfiltration with maliciously crafted repository", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-22490" }, { "category": "external", "summary": "RHBZ#2168160", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168160" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-22490", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22490" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-22490", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22490" }, { "category": "external", "summary": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/", "url": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/" }, { "category": "external", "summary": "https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q", "url": "https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q" } ], "release_date": "2023-02-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "- Avoid cloning repositories from untrusted sources with --recurse-submodules.\n- Instead, consider cloning repositories without recursively cloning their submodules, and instead run git submodule update at each layer. Before doing so, inspect each new .gitmodules file to ensure that it does not contain suspicious module URLs.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: data exfiltration with maliciously crafted repository" }, { "cve": "CVE-2023-23946", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2023-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168161" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This security issue occurs when feeding a crafted input to \"git apply.\" A path outside the working tree can be overwritten by the user running \"git apply.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git apply: a path outside the working tree can be overwritten with crafted input", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability marked as Moderate severity and it\u0027s less likely to be exploitable because it requires a specially crafted malicious patch to be applied via git apply, to overwrite files outside the working tree of the user running git apply. This could lead to some compromise of integrity of resources under certain circumstances, however it does not compromise the whole system or gain additional privileges to execute arbitrary code, or allow remote users to cause a denial of service.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23946" }, { "category": "external", "summary": "RHBZ#2168161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168161" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23946", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23946" }, { "category": "external", "summary": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/", "url": "https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/" }, { "category": "external", "summary": "https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh", "url": "https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh" } ], "release_date": "2023-02-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-25T08:01:33+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0407" }, { "category": "workaround", "details": "Use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.", "product_ids": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.src", "AppStream-8.6.0.Z.EUS:git-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-all-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-core-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-core-doc-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-credential-libsecret-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-daemon-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debuginfo-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-debugsource-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-email-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-gui-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-instaweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.aarch64", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.ppc64le", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.s390x", "AppStream-8.6.0.Z.EUS:git-subtree-0:2.31.8-1.el8_6.x86_64", "AppStream-8.6.0.Z.EUS:git-svn-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitk-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:gitweb-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-0:2.31.8-1.el8_6.noarch", "AppStream-8.6.0.Z.EUS:perl-Git-SVN-0:2.31.8-1.el8_6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git apply: a path outside the working tree can be overwritten with crafted input" } ] }
rhsa-2023_2859
Vulnerability from csaf_redhat
Published
2023-05-16 08:32
Modified
2024-11-22 21:15
Summary
Red Hat Security Advisory: git security and bug fix update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2859", "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139378" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2859.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-22T21:15:36+00:00", "generator": { "date": "2024-11-22T21:15:36+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2859", "initial_release_date": "2023-05-16T08:32:51+00:00", "revision_history": [ { "date": "2023-05-16T08:32:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-16T08:32:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:15:36+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.src", "product": { "name": "git-0:2.39.1-1.el8.src", "product_id": "git-0:2.39.1-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.aarch64", "product": { "name": "git-0:2.39.1-1.el8.aarch64", "product_id": "git-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.aarch64", "product": { "name": "git-core-0:2.39.1-1.el8.aarch64", "product_id": "git-core-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el8.aarch64", "product_id": "git-daemon-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el8.aarch64", "product_id": "git-subtree-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el8.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-0:2.39.1-1.el8.ppc64le", "product_id": "git-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el8.ppc64le", "product_id": "git-core-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el8.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el8.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.x86_64", "product": { "name": "git-0:2.39.1-1.el8.x86_64", "product_id": "git-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.x86_64", "product": { "name": "git-core-0:2.39.1-1.el8.x86_64", "product_id": "git-core-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el8.x86_64", "product_id": "git-daemon-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el8.x86_64", "product_id": "git-subtree-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el8.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el8.s390x", "product": { "name": "git-0:2.39.1-1.el8.s390x", "product_id": "git-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el8.s390x", "product": { "name": "git-core-0:2.39.1-1.el8.s390x", "product_id": "git-core-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el8.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el8.s390x", "product_id": "git-daemon-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el8.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el8.s390x", "product_id": "git-subtree-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el8.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el8.s390x", "product_id": "git-debugsource-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el8?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el8.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el8.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el8.noarch", "product": { "name": "git-all-0:2.39.1-1.el8.noarch", "product_id": "git-all-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el8.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el8.noarch", "product_id": "git-core-doc-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el8.noarch", "product": { "name": "git-email-0:2.39.1-1.el8.noarch", "product_id": "git-email-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el8.noarch", "product": { "name": "git-gui-0:2.39.1-1.el8.noarch", "product_id": "git-gui-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el8.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el8.noarch", "product_id": "git-instaweb-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el8.noarch", "product": { "name": "git-svn-0:2.39.1-1.el8.noarch", "product_id": "git-svn-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el8.noarch", "product": { "name": "gitk-0:2.39.1-1.el8.noarch", "product_id": "gitk-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el8.noarch", "product": { "name": "gitweb-0:2.39.1-1.el8.noarch", "product_id": "gitweb-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el8.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el8.noarch", "product_id": "perl-Git-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x" }, "product_reference": "git-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src" }, "product_reference": "git-0:2.39.1-1.el8.src", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch" }, "product_reference": "git-all-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x" }, "product_reference": "git-core-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch" }, "product_reference": "git-email-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el8.s390x", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch" }, "product_reference": "gitk-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el8.noarch", "relates_to_product_reference": "AppStream-8.8.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree" }, { "cve": "CVE-2022-29187", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107439" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: Bypass of safe.directory protections", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw occurs due to an incomplete fix of CVE-2022-24765.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29187" }, { "category": "external", "summary": "RHBZ#2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29187", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29187" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29187" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: Bypass of safe.directory protections" }, { "cve": "CVE-2022-39253", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137422" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source\u0027s `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim\u0027s machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: exposure of sensitive information to a malicious actor", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39253" }, { "category": "external", "summary": "RHBZ#2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39253", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39253" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "workaround", "details": "Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: exposure of sensitive information to a malicious actor" }, { "cve": "CVE-2022-39260", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137423" } ], "notes": [ { "category": "description", "text": "Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git\u0027s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: git shell function that splits command arguments can lead to arbitrary heap writes.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39260" }, { "category": "external", "summary": "RHBZ#2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39260" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39260" } ], "release_date": "2022-10-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-16T08:32:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2859" }, { "category": "workaround", "details": "Disabling `git shell` access via remote logins is a viable short-term workaround.", "product_ids": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.src", "AppStream-8.8.0.GA:git-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-all-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-core-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-core-doc-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-daemon-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debuginfo-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-debugsource-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-email-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-gui-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-instaweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.aarch64", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.ppc64le", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.s390x", "AppStream-8.8.0.GA:git-subtree-0:2.39.1-1.el8.x86_64", "AppStream-8.8.0.GA:git-svn-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitk-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:gitweb-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-0:2.39.1-1.el8.noarch", "AppStream-8.8.0.GA:perl-Git-SVN-0:2.39.1-1.el8.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "git: git shell function that splits command arguments can lead to arbitrary heap writes." } ] }
RHSA-2023:2319
Vulnerability from csaf_redhat
Published
2023-05-09 10:03
Modified
2024-11-22 21:15
Summary
Red Hat Security Advisory: git security and bug fix update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)
* git: Bypass of safe.directory protections (CVE-2022-29187)
* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for git is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree (CVE-2022-24765)\n\n* git: Bypass of safe.directory protections (CVE-2022-29187)\n\n* git: exposure of sensitive information to a malicious actor (CVE-2022-39253)\n\n* git: git shell function that splits command arguments can lead to arbitrary heap writes. (CVE-2022-39260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2319", "url": "https://access.redhat.com/errata/RHSA-2023:2319" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index" }, { "category": "external", "summary": "2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "2107439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107439" }, { "category": "external", "summary": "2137422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137422" }, { "category": "external", "summary": "2137423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137423" }, { "category": "external", "summary": "2139379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2319.json" } ], "title": "Red Hat Security Advisory: git security and bug fix update", "tracking": { "current_release_date": "2024-11-22T21:15:27+00:00", "generator": { "date": "2024-11-22T21:15:27+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2319", "initial_release_date": "2023-05-09T10:03:04+00:00", "revision_history": [ { "date": "2023-05-09T10:03:04+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-09T10:03:04+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:15:27+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.src", "product": { "name": "git-0:2.39.1-1.el9.src", "product_id": "git-0:2.39.1-1.el9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.aarch64", "product": { "name": "git-0:2.39.1-1.el9.aarch64", "product_id": "git-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-0:2.39.1-1.el9.aarch64", "product_id": "git-core-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product": { "name": "git-subtree-0:2.39.1-1.el9.aarch64", "product_id": "git-subtree-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_id": "git-debugsource-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=aarch64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_id": "git-debuginfo-0:2.39.1-1.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-0:2.39.1-1.el9.ppc64le", "product_id": "git-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_id": "git-subtree-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_id": "git-debugsource-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_id": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.x86_64", "product": { "name": "git-0:2.39.1-1.el9.x86_64", "product_id": "git-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-0:2.39.1-1.el9.x86_64", "product_id": "git-core-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product": { "name": "git-subtree-0:2.39.1-1.el9.x86_64", "product_id": "git-subtree-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_id": "git-debugsource-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=x86_64" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_id": "git-debuginfo-0:2.39.1-1.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "git-0:2.39.1-1.el9.s390x", "product": { "name": "git-0:2.39.1-1.el9.s390x", "product_id": "git-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-0:2.39.1-1.el9.s390x", "product_id": "git-core-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-subtree-0:2.39.1-1.el9.s390x", "product": { "name": "git-subtree-0:2.39.1-1.el9.s390x", "product_id": "git-subtree-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-subtree@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product": { "name": "git-debugsource-0:2.39.1-1.el9.s390x", "product_id": "git-debugsource-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debugsource@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.39.1-1.el9?arch=s390x" } } }, { "category": "product_version", "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_id": "git-debuginfo-0:2.39.1-1.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-debuginfo@2.39.1-1.el9?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "git-all-0:2.39.1-1.el9.noarch", "product": { "name": "git-all-0:2.39.1-1.el9.noarch", "product_id": "git-all-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-all@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product": { "name": "git-core-doc-0:2.39.1-1.el9.noarch", "product_id": "git-core-doc-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-core-doc@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-email-0:2.39.1-1.el9.noarch", "product": { "name": "git-email-0:2.39.1-1.el9.noarch", "product_id": "git-email-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-email@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-gui-0:2.39.1-1.el9.noarch", "product": { "name": "git-gui-0:2.39.1-1.el9.noarch", "product_id": "git-gui-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-gui@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product": { "name": "git-instaweb-0:2.39.1-1.el9.noarch", "product_id": "git-instaweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-instaweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "git-svn-0:2.39.1-1.el9.noarch", "product": { "name": "git-svn-0:2.39.1-1.el9.noarch", "product_id": "git-svn-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/git-svn@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitk-0:2.39.1-1.el9.noarch", "product": { "name": "gitk-0:2.39.1-1.el9.noarch", "product_id": "gitk-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitk@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "gitweb-0:2.39.1-1.el9.noarch", "product": { "name": "gitweb-0:2.39.1-1.el9.noarch", "product_id": "gitweb-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/gitweb@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git@2.39.1-1.el9?arch=noarch" } } }, { "category": "product_version", "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_id": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/perl-Git-SVN@2.39.1-1.el9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x" }, "product_reference": "git-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src" }, "product_reference": "git-0:2.39.1-1.el9.src", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-all-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch" }, "product_reference": "git-all-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-core-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-core-doc-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch" }, "product_reference": "git-core-doc-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debuginfo-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debuginfo-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-debugsource-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-debugsource-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-email-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch" }, "product_reference": "git-email-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-gui-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch" }, "product_reference": "git-gui-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-instaweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch" }, "product_reference": "git-instaweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.aarch64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le" }, "product_reference": "git-subtree-0:2.39.1-1.el9.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x" }, "product_reference": "git-subtree-0:2.39.1-1.el9.s390x", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-subtree-0:2.39.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64" }, "product_reference": "git-subtree-0:2.39.1-1.el9.x86_64", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "git-svn-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch" }, "product_reference": "git-svn-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitk-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch" }, "product_reference": "gitk-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "gitweb-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch" }, "product_reference": "gitweb-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "perl-Git-SVN-0:2.39.1-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" }, "product_reference": "perl-Git-SVN-0:2.39.1-1.el9.noarch", "relates_to_product_reference": "AppStream-9.2.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-24765", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "discovery_date": "2022-04-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073414" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24765" }, { "category": "external", "summary": "RHBZ#2073414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073414" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24765", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24765" }, { "category": "external", "summary": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2" } ], "release_date": "2022-04-12T10:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T10:03:04+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.src", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-all-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-core-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-core-doc-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-credential-libsecret-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-daemon-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debuginfo-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-debugsource-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-email-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-gui-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-instaweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.s390x", "AppStream-9.2.0.GA:git-subtree-0:2.39.1-1.el9.x86_64", "AppStream-9.2.0.GA:git-svn-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitk-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:gitweb-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-0:2.39.1-1.el9.noarch", "AppStream-9.2.0.GA:perl-Git-SVN-0:2.39.1-1.el9.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2319" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.aarch64", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.ppc64le", "AppStream-9.2.0.GA:git-0:2.39.1-1.el9.s390x", "