[gentoo-announce] [ GLSA 202003-30 ] Git: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202003-30 ] Git: Multiple vulnerabilities
Date:	Sun, 15 Mar 2020 17:01:14
Message-Id:	`11eeead3-8430-88ba-9c88-9f4775d726aa@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202003-30

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: Git: Multiple vulnerabilities

9

     Date: March 15, 2020

10

     Bugs: #702296

11

       ID: 202003-30

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in Git, the worst of which

19

could result in the arbitrary execution of code.

20

21

Background

22

==========

23

24

Git is a free and open source distributed version control system

25

designed to handle everything from small to very large projects with

26

speed and efficiency.

27

28

Affected packages

29

=================

30

31

    -------------------------------------------------------------------

32

     Package              /     Vulnerable     /            Unaffected

33

    -------------------------------------------------------------------

34

  1  dev-vcs/git                  < 2.21.1                  >= 2.21.1

35

                                < 2.23.1-r1              >= 2.23.1-r1

36

                                  < 2.24.1                  >= 2.24.1

37

38

Description

39

===========

40

41

Multiple vulnerabilities have been discovered in Git. Please review the

42

CVE identifiers referenced below for details.

43

44

Impact

45

======

46

47

An attacker could possibly overwrite arbitrary paths, execute arbitrary

48

code, and overwrite files in the .git directory.

49

50

Workaround

51

==========

52

53

There is no known workaround at this time.

54

55

Resolution

56

==========

57

58

All Git 2.21.x users should upgrade to the latest version:

59

60

  # emerge --sync

61

  # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.21.1"

62

63

All Git 2.23.x users should upgrade to the latest version:

64

65

  # emerge --sync

66

  # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.23.1-r1"

67

68

All Git 2.24.x users should upgrade to the latest version:

69

70

  # emerge --sync

71

  # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.24.1"

72

73

References

74

==========

75

76

[ 1 ] CVE-2019-1348

77

      https://nvd.nist.gov/vuln/detail/CVE-2019-1348

78

[ 2 ] CVE-2019-1349

79

      https://nvd.nist.gov/vuln/detail/CVE-2019-1349

80

[ 3 ] CVE-2019-1350

81

      https://nvd.nist.gov/vuln/detail/CVE-2019-1350

82

[ 4 ] CVE-2019-1351

83

      https://nvd.nist.gov/vuln/detail/CVE-2019-1351

84

[ 5 ] CVE-2019-1352

85

      https://nvd.nist.gov/vuln/detail/CVE-2019-1352

86

[ 6 ] CVE-2019-1353

87

      https://nvd.nist.gov/vuln/detail/CVE-2019-1353

88

[ 7 ] CVE-2019-1354

89

      https://nvd.nist.gov/vuln/detail/CVE-2019-1354

90

[ 8 ] CVE-2019-1387

91

      https://nvd.nist.gov/vuln/detail/CVE-2019-1387

92

[ 9 ] CVE-2019-19604

93

      https://nvd.nist.gov/vuln/detail/CVE-2019-19604

94

95

Availability

96

============

97

98

This GLSA and any updates to it are available for viewing at

99

the Gentoo Security Website:

100

101

 https://security.gentoo.org/glsa/202003-30

102

103

Concerns?

104

=========

105

106

Security is a primary focus of Gentoo Linux and ensuring the

107

confidentiality and security of our users' machines is of utmost

108

importance to us. Any security concerns should be addressed to

109

security@g.o or alternatively, you may file a bug at

110

https://bugs.gentoo.org.

111

112

License

113

=======

114

115

Copyright 2020 Gentoo Foundation, Inc; referenced text

116

belongs to its owner(s).

117

118

The contents of this document are licensed under the

119

Creative Commons - Attribution / Share Alike license.

120

121

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202003-30
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: Git: Multiple vulnerabilities
9	Date: March 15, 2020
10	Bugs: #702296
11	ID: 202003-30
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in Git, the worst of which
19	could result in the arbitrary execution of code.
20
21	Background
22	==========
23
24	Git is a free and open source distributed version control system
25	designed to handle everything from small to very large projects with
26	speed and efficiency.
27
28	Affected packages
29	=================
30
31	-------------------------------------------------------------------
32	Package / Vulnerable / Unaffected
33	-------------------------------------------------------------------
34	1 dev-vcs/git < 2.21.1 >= 2.21.1
35	< 2.23.1-r1 >= 2.23.1-r1
36	< 2.24.1 >= 2.24.1
37
38	Description
39	===========
40
41	Multiple vulnerabilities have been discovered in Git. Please review the
42	CVE identifiers referenced below for details.
43
44	Impact
45	======
46
47	An attacker could possibly overwrite arbitrary paths, execute arbitrary
48	code, and overwrite files in the .git directory.
49
50	Workaround
51	==========
52
53	There is no known workaround at this time.
54
55	Resolution
56	==========
57
58	All Git 2.21.x users should upgrade to the latest version:
59
60	# emerge --sync
61	# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.21.1"
62
63	All Git 2.23.x users should upgrade to the latest version:
64
65	# emerge --sync
66	# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.23.1-r1"
67
68	All Git 2.24.x users should upgrade to the latest version:
69
70	# emerge --sync
71	# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.24.1"
72
73	References
74	==========
75
76	[ 1 ] CVE-2019-1348
77	https://nvd.nist.gov/vuln/detail/CVE-2019-1348
78	[ 2 ] CVE-2019-1349
79	https://nvd.nist.gov/vuln/detail/CVE-2019-1349
80	[ 3 ] CVE-2019-1350
81	https://nvd.nist.gov/vuln/detail/CVE-2019-1350
82	[ 4 ] CVE-2019-1351
83	https://nvd.nist.gov/vuln/detail/CVE-2019-1351
84	[ 5 ] CVE-2019-1352
85	https://nvd.nist.gov/vuln/detail/CVE-2019-1352
86	[ 6 ] CVE-2019-1353
87	https://nvd.nist.gov/vuln/detail/CVE-2019-1353
88	[ 7 ] CVE-2019-1354
89	https://nvd.nist.gov/vuln/detail/CVE-2019-1354
90	[ 8 ] CVE-2019-1387
91	https://nvd.nist.gov/vuln/detail/CVE-2019-1387
92	[ 9 ] CVE-2019-19604
93	https://nvd.nist.gov/vuln/detail/CVE-2019-19604
94
95	Availability
96	============
97
98	This GLSA and any updates to it are available for viewing at
99	the Gentoo Security Website:
100
101	https://security.gentoo.org/glsa/202003-30
102
103	Concerns?
104	=========
105
106	Security is a primary focus of Gentoo Linux and ensuring the
107	confidentiality and security of our users' machines is of utmost
108	importance to us. Any security concerns should be addressed to
109	security@g.o or alternatively, you may file a bug at
110	https://bugs.gentoo.org.
111
112	License
113	=======
114
115	Copyright 2020 Gentoo Foundation, Inc; referenced text
116	belongs to its owner(s).
117
118	The contents of this document are licensed under the
119	Creative Commons - Attribution / Share Alike license.
120
121	https://creativecommons.org/licenses/by-sa/2.5