Stay Secure with the Latest Linux Advisories

security advisoryimportantarbitrary code

SUSE: 2024:1807-2 Important: Git Security Issues and Fixes

* bsc#1224168 * bsc#1224170 * bsc#1224171 * bsc#1224172 * bsc#1224173 . # Security update for git Announcement ID: SUSE-SU-2024:1807-2 Rating: important References: * bsc#1224168 * bsc#1224170 * bsc#1224171 * bsc#1224172 * bsc#1224173 Cross-References: * CVE-2024-32002 * CVE-2024-32004 * CVE-2024-32020 * CVE-2024-32021 * CVE-2024-32465 CVSS scores: * CVE-2024-32002 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-32002 ( NVD ): 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2024-32004 ( SUSE ): 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2024-32020 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L * CVE-2024-32021 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L * CVE-2024-32465 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Micro 5.5 An update that solves five vulnerabilities can now be installed. ## Description: This update for git fixes the following issues: * CVE-2024-32002: Fixed recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion (bsc#1224168). * CVE-2024-32004: Fixed arbitrary code execution during local clones (bsc#1224170). * CVE-2024-32020: Fixed file overwriting vulnerability during local clones (bsc#1224171). * CVE-2024-32021: Fixed git may create hardlinks to arbitrary user-readable files (bsc#1224172). * CVE-2024-32465: Fixed arbitrary code execution during clone operations (bsc#1224173). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1807=1 ## Package List: * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * perl-Git-2.35.3-150300.10.39.1 *git-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32002.html * https://www.suse.com/security/cve/CVE-2024-32004.html * https://www.suse.com/security/cve/CVE-2024-32020.html * https://www.suse.com/security/cve/CVE-2024-32021.html * https://www.suse.com/security/cve/CVE-2024-32465.html * https://bugzilla.suse.com/show_bug.cgi?id=1224168 * https://bugzilla.suse.com/show_bug.cgi?id=1224170 * https://bugzilla.suse.com/show_bug.cgi?id=1224171 * https://bugzilla.suse.com/show_bug.cgi?id=1224172 * https://bugzilla.suse.com/show_bug.cgi?id=1224173 . A new Git security update for SUSE Linux Enterprise Micro 5.5 addresses vulnerabilities risking code execution and unauthorized access. Prompt patching is essential. SUSE Linux, git security, patch update, case confusion, code execution. . Severity: Important. LinuxSecurity.com Team

Jul 12, 2024 •Important SuSE