MGASA-2023-0066 - Updated git packages fix security vulnerability

Publication date: 27 Feb 2023
URL: https://advisories.mageia.org/MGASA-2023-0066.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2023-22490,
     CVE-2023-23946

Using a specially-crafted repository, Git can be tricked into using its local
clone optimization even when using a non-local transport. Though Git will
abort local clones whose source $GIT_DIR/objects directory contains symbolic
links, the objects directory itself may still be a symbolic link. These two
may be combined to include arbitrary files based on known paths on the
victim's filesystem within the malicious repository's working copy, allowing
for data exfiltration in a similar manner as CVE-2022-39253 (CVE-2023-22490).

By feeding a crafted input to "git apply", a path outside the working tree can
be overwritten as the user who is running "git apply" (CVE-2023-23946).

References:
- https://bugs.mageia.org/show_bug.cgi?id=31553
- https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.30.8.txt
- https://lore.kernel.org/git/004a01d940a4$289e56a0$79db03e0$@nexbridge.com/T/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22490
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23946

SRPMS:
- 8/core/git-2.30.8-1.mga8