Alerts This Week
Warning Icon 1 664
Alerts This Week
Warning Icon 1 664

openSUSE Leap 15.1: Important Git Update for Multiple Issues

opensuse
Calendar Grey January 29, 2020
Dist Opensuse Esm H88
Essential patch for openSUSE Leap 15.1 resolves various vulnerabilities in git, implementing significant corrections.
An update that solves 9 vulnerabilities and has two fixes is now available.

Description

This update for git fixes the following issues:

Security issues fixed:

- CVE-2019-1349: Fixed issue on Windows, when submodules are cloned

recursively, under certain circumstances Git could be fooled into using

the same Git directory twice (bsc#1158787).

- CVE-2019-19604: Fixed a recursive clone followed by a submodule update

could execute code contained within the repository without the user

explicitly having asked for that (bsc#1158795).

- CVE-2019-1387: Fixed recursive clones that are currently affected by a

vulnerability that is caused by too-lax validation of submodule names,

allowing very targeted attacks via remote code execution in recursive

clones (bsc#1158793).

- CVE-2019-1354: Fixed issue on Windows that refuses to write tracked

files with filenames that contain backslashes (bsc#1158792).

- CVE-2019-1353: Fixed issue when run in the Windows Subsystem for Linux

while accessing a working directory on a...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory code execution important remote code Windows openSUSE git

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2020-123=1

Package List

- openSUSE Leap 15.1 (i586 x86_64):

git-2.16.4-lp151.4.3.1

git-arch-2.16.4-lp151.4.3.1

git-core-2.16.4-lp151.4.3.1

git-core-debuginfo-2.16.4-lp151.4.3.1

git-credential-gnome-keyring-2.16.4-lp151.4.3.1

git-credential-gnome-keyring-debuginfo-2.16.4-lp151.4.3.1

git-credential-libsecret-2.16.4-lp151.4.3.1

git-credential-libsecret-debuginfo-2.16.4-lp151.4.3.1

git-cvs-2.16.4-lp151.4.3.1

git-daemon-2.16.4-lp151.4.3.1

git-daemon-debuginfo-2.16.4-lp151.4.3.1

git-debuginfo-2.16.4-lp151.4.3.1

git-debugsource-2.16.4-lp151.4.3.1

git-email-2.16.4-lp151.4.3.1

git-gui-2.16.4-lp151.4.3.1

git-p4-2.16.4-lp151.4.3.1

git-svn-2.16.4-lp151.4.3.1

git-svn-debuginfo-2.16.4-lp151.4.3.1

git-web-2.16.4-lp151.4.3.1

gitk-2.16.4-lp151.4.3.1

- openSUSE Leap 15.1 (noarch):

git-doc-2.16.4-lp151.4.3.1

perl-Authen-SASL-2.16-lp151.3.3.1

perl-Net-SMTP-SSL-1.04-lp151.3.3.1

References

https://www.suse.com/security/cve/CVE-2019-1348.html

https://www.suse.com/security/cve/CVE-2019-1349.html

https://www.suse.com/security/cve/CVE-2019-1350.html

https://www.suse.com/security/cve/CVE-2019-1351.html

https://www.suse.com/security/cve/CVE-2019-1352.html

https://www.suse.com/security/cve/CVE-2019-1353.html

https://www.suse.com/security/cve/CVE-2019-1354.html

https://www.suse.com/security/cve/CVE-2019-1387.html

https://www.suse.com/security/cve/CVE-2019-19604.html

https://bugzilla.suse.com/1082023

https://bugzilla.suse.com/1149792

https://bugzilla.suse.com/1158785

https://bugzilla.suse.com/1158787

https://bugzilla.suse.com/1158788

https://bugzilla.suse.com/1158789

https://bugzilla.suse.com/1158790

https://bugzilla.suse.com/1158791

https://bugzilla.suse.com/1158792

https://bugzilla.suse.com/1158793

https://bugzilla.suse.com/1158795

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2020:0123-1
Rating: important
Affected Products: openSUSE Leap 15.1 le.

Topics%20covered

Topics Covered

security advisory code execution important remote code Windows openSUSE git

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here