Red Hat Product Errata RHSA-2023:0609 - Security Advisory
Issued:
2023-02-06
Updated:
2023-02-06

RHSA-2023:0609 - Security Advisory

Synopsis

Important: git security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for git is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

  • git: gitattributes parsing integer overflow (CVE-2022-23521)
  • git: Heap overflow in `git archive`, `git log --format` leading to RCE (CVE-2022-41903)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64
  • Red Hat Enterprise Linux Server - TUS 8.2 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64

Fixes

  • BZ - 2162055 - CVE-2022-23521 git: gitattributes parsing integer overflow
  • BZ - 2162056 - CVE-2022-41903 git: Heap overflow in `git archive`, `git log --format` leading to RCE

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
git-2.18.4-3.el8_2.src.rpm SHA-256: 1e44a91039c3775efcc48bfbff9d777200d3b594af38343f3d9a27256b15065b
x86_64
git-2.18.4-3.el8_2.x86_64.rpm SHA-256: c1de6ab86f6491ecb03d0d6bac2ce23979f2697a5aecc045273ac14a3710259b
git-all-2.18.4-3.el8_2.noarch.rpm SHA-256: 2f7b667cae79e4ebaec60a7b6f45fa554df603a2ed5c0bfda8030ed622836228
git-core-2.18.4-3.el8_2.x86_64.rpm SHA-256: afe4dbf85d4c9b6121e20345a8e10d140f7b5e5607c0217d6c89dae6690e82c9
git-core-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: 121657287371655f84ab37195de765054d5e8a391d73ce05283ad98a10e6b8c0
git-core-doc-2.18.4-3.el8_2.noarch.rpm SHA-256: 5ec9ff8f4ff570a4188d6bf5ac18d520174651519212990ce19ffd02ae644645
git-daemon-2.18.4-3.el8_2.x86_64.rpm SHA-256: 02428b3c36d82eb611764dc078fb0040198eb918f6664e6a15adc14c4f13907e
git-daemon-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: 6ea33f57fba614dc1581dade2459b1726b261098c8e7a3cabbe793567ee642d5
git-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: bb403256ea03efa30cbd2627706e95574c80ec1c0b132a729148885b376e31f8
git-debugsource-2.18.4-3.el8_2.x86_64.rpm SHA-256: cbd38afc69c298fff22a84bd51d73db4d32a0ae2a1e1e13727891508e6c8491e
git-email-2.18.4-3.el8_2.noarch.rpm SHA-256: 725f9dd78deb873fdb4db718abccf4c4b54f0fd25596aca53c0394a9f99acda6
git-gui-2.18.4-3.el8_2.noarch.rpm SHA-256: 532761abf0dc486c8d72870523590568940211b4f4ff10444cfc5f2a456fa87c
git-instaweb-2.18.4-3.el8_2.x86_64.rpm SHA-256: 829a290f3cf272dbce94ecec4f7b3f847e18e724344b6a8997261e60d11f5835
git-subtree-2.18.4-3.el8_2.x86_64.rpm SHA-256: 30be54ca22a9205cb96658ae146abe131a613dff6a2f7c47b045a1d62d0e2666
git-svn-2.18.4-3.el8_2.x86_64.rpm SHA-256: 24ce18f609c27fe5040e392f545f9885e3c5ee182ed107bfc145fd4c4cb33dc7
git-svn-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: cbfabe763ed5853e70881d83c6aab22707434de23da27ac652d9e9e6fc80d865
gitk-2.18.4-3.el8_2.noarch.rpm SHA-256: ae458d7e462126a41ea8f79cb74538404a0b5d59fe08a26a2c11ecd46ce2b951
gitweb-2.18.4-3.el8_2.noarch.rpm SHA-256: ba38d654e3e456cb54b8c4e61d61dfe7f1b9af40121490e5d532b718eb41b35f
perl-Git-2.18.4-3.el8_2.noarch.rpm SHA-256: d3c2bd64ad2c6d8a4dde3432ba4dd51874e46b8ca1d5b30994c530652eca8935
perl-Git-SVN-2.18.4-3.el8_2.noarch.rpm SHA-256: 7065efcc1dce0f5a56676346d04ce1c8c1043e93dcb362a04eda633ce26bd872

Red Hat Enterprise Linux Server - TUS 8.2

SRPM
git-2.18.4-3.el8_2.src.rpm SHA-256: 1e44a91039c3775efcc48bfbff9d777200d3b594af38343f3d9a27256b15065b
x86_64
git-2.18.4-3.el8_2.x86_64.rpm SHA-256: c1de6ab86f6491ecb03d0d6bac2ce23979f2697a5aecc045273ac14a3710259b
git-all-2.18.4-3.el8_2.noarch.rpm SHA-256: 2f7b667cae79e4ebaec60a7b6f45fa554df603a2ed5c0bfda8030ed622836228
git-core-2.18.4-3.el8_2.x86_64.rpm SHA-256: afe4dbf85d4c9b6121e20345a8e10d140f7b5e5607c0217d6c89dae6690e82c9
git-core-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: 121657287371655f84ab37195de765054d5e8a391d73ce05283ad98a10e6b8c0
git-core-doc-2.18.4-3.el8_2.noarch.rpm SHA-256: 5ec9ff8f4ff570a4188d6bf5ac18d520174651519212990ce19ffd02ae644645
git-daemon-2.18.4-3.el8_2.x86_64.rpm SHA-256: 02428b3c36d82eb611764dc078fb0040198eb918f6664e6a15adc14c4f13907e
git-daemon-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: 6ea33f57fba614dc1581dade2459b1726b261098c8e7a3cabbe793567ee642d5
git-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: bb403256ea03efa30cbd2627706e95574c80ec1c0b132a729148885b376e31f8
git-debugsource-2.18.4-3.el8_2.x86_64.rpm SHA-256: cbd38afc69c298fff22a84bd51d73db4d32a0ae2a1e1e13727891508e6c8491e
git-email-2.18.4-3.el8_2.noarch.rpm SHA-256: 725f9dd78deb873fdb4db718abccf4c4b54f0fd25596aca53c0394a9f99acda6
git-gui-2.18.4-3.el8_2.noarch.rpm SHA-256: 532761abf0dc486c8d72870523590568940211b4f4ff10444cfc5f2a456fa87c
git-instaweb-2.18.4-3.el8_2.x86_64.rpm SHA-256: 829a290f3cf272dbce94ecec4f7b3f847e18e724344b6a8997261e60d11f5835
git-subtree-2.18.4-3.el8_2.x86_64.rpm SHA-256: 30be54ca22a9205cb96658ae146abe131a613dff6a2f7c47b045a1d62d0e2666
git-svn-2.18.4-3.el8_2.x86_64.rpm SHA-256: 24ce18f609c27fe5040e392f545f9885e3c5ee182ed107bfc145fd4c4cb33dc7
git-svn-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: cbfabe763ed5853e70881d83c6aab22707434de23da27ac652d9e9e6fc80d865
gitk-2.18.4-3.el8_2.noarch.rpm SHA-256: ae458d7e462126a41ea8f79cb74538404a0b5d59fe08a26a2c11ecd46ce2b951
gitweb-2.18.4-3.el8_2.noarch.rpm SHA-256: ba38d654e3e456cb54b8c4e61d61dfe7f1b9af40121490e5d532b718eb41b35f
perl-Git-2.18.4-3.el8_2.noarch.rpm SHA-256: d3c2bd64ad2c6d8a4dde3432ba4dd51874e46b8ca1d5b30994c530652eca8935
perl-Git-SVN-2.18.4-3.el8_2.noarch.rpm SHA-256: 7065efcc1dce0f5a56676346d04ce1c8c1043e93dcb362a04eda633ce26bd872

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2

SRPM
git-2.18.4-3.el8_2.src.rpm SHA-256: 1e44a91039c3775efcc48bfbff9d777200d3b594af38343f3d9a27256b15065b
ppc64le
git-2.18.4-3.el8_2.ppc64le.rpm SHA-256: 5cd112f66427eb9f980b5939e9f34ac4df3c2c06d9325f6f706f79a98535aead
git-all-2.18.4-3.el8_2.noarch.rpm SHA-256: 2f7b667cae79e4ebaec60a7b6f45fa554df603a2ed5c0bfda8030ed622836228
git-core-2.18.4-3.el8_2.ppc64le.rpm SHA-256: c1041fb88d0e4b71ca56e3f53cdfcdd44077877c5fc0a0e7ab3f0e8155a27159
git-core-debuginfo-2.18.4-3.el8_2.ppc64le.rpm SHA-256: e18509ae5e7debc83b0a85866c3e3681934b104291ec1543dea5c316f3dac5e9
git-core-doc-2.18.4-3.el8_2.noarch.rpm SHA-256: 5ec9ff8f4ff570a4188d6bf5ac18d520174651519212990ce19ffd02ae644645
git-daemon-2.18.4-3.el8_2.ppc64le.rpm SHA-256: d4900cd4c9f7aa2ea1de15b8cd251d5b28e801c2486e109702354fb774a8155c
git-daemon-debuginfo-2.18.4-3.el8_2.ppc64le.rpm SHA-256: e28ced9897058664052f2f17adada92853f9dcad84c5032dc1aeaa6ec543b7b1
git-debuginfo-2.18.4-3.el8_2.ppc64le.rpm SHA-256: dc7af65947f4a337e2de05ff721a74ce1c5d2486249f339ae42c45970a0406b0
git-debugsource-2.18.4-3.el8_2.ppc64le.rpm SHA-256: ccf1342bbf95ad32c6af7b5ef864038526cff8109d913aeadea14ee6db72b9c1
git-email-2.18.4-3.el8_2.noarch.rpm SHA-256: 725f9dd78deb873fdb4db718abccf4c4b54f0fd25596aca53c0394a9f99acda6
git-gui-2.18.4-3.el8_2.noarch.rpm SHA-256: 532761abf0dc486c8d72870523590568940211b4f4ff10444cfc5f2a456fa87c
git-instaweb-2.18.4-3.el8_2.ppc64le.rpm SHA-256: 7470ba8009cc09d7133b5c0d312a7cd0b8bbc40ea164f53c5bdbd0dae30ae1a0
git-subtree-2.18.4-3.el8_2.ppc64le.rpm SHA-256: 241e197d9d93d9c4fe7bf294ee7e809c28e31abb761915dc4c8d35e9b17bf141
git-svn-2.18.4-3.el8_2.ppc64le.rpm SHA-256: 030cde5e7ea5ce64272af540ea56011e6f9dd9d2f055209c668f9431788f6ea9
git-svn-debuginfo-2.18.4-3.el8_2.ppc64le.rpm SHA-256: a09be6851454e28c137dff4b6b783cef5883b0dd97b9a26de56b51f8b6d68cec
gitk-2.18.4-3.el8_2.noarch.rpm SHA-256: ae458d7e462126a41ea8f79cb74538404a0b5d59fe08a26a2c11ecd46ce2b951
gitweb-2.18.4-3.el8_2.noarch.rpm SHA-256: ba38d654e3e456cb54b8c4e61d61dfe7f1b9af40121490e5d532b718eb41b35f
perl-Git-2.18.4-3.el8_2.noarch.rpm SHA-256: d3c2bd64ad2c6d8a4dde3432ba4dd51874e46b8ca1d5b30994c530652eca8935
perl-Git-SVN-2.18.4-3.el8_2.noarch.rpm SHA-256: 7065efcc1dce0f5a56676346d04ce1c8c1043e93dcb362a04eda633ce26bd872

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2

SRPM
git-2.18.4-3.el8_2.src.rpm SHA-256: 1e44a91039c3775efcc48bfbff9d777200d3b594af38343f3d9a27256b15065b
x86_64
git-2.18.4-3.el8_2.x86_64.rpm SHA-256: c1de6ab86f6491ecb03d0d6bac2ce23979f2697a5aecc045273ac14a3710259b
git-all-2.18.4-3.el8_2.noarch.rpm SHA-256: 2f7b667cae79e4ebaec60a7b6f45fa554df603a2ed5c0bfda8030ed622836228
git-core-2.18.4-3.el8_2.x86_64.rpm SHA-256: afe4dbf85d4c9b6121e20345a8e10d140f7b5e5607c0217d6c89dae6690e82c9
git-core-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: 121657287371655f84ab37195de765054d5e8a391d73ce05283ad98a10e6b8c0
git-core-doc-2.18.4-3.el8_2.noarch.rpm SHA-256: 5ec9ff8f4ff570a4188d6bf5ac18d520174651519212990ce19ffd02ae644645
git-daemon-2.18.4-3.el8_2.x86_64.rpm SHA-256: 02428b3c36d82eb611764dc078fb0040198eb918f6664e6a15adc14c4f13907e
git-daemon-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: 6ea33f57fba614dc1581dade2459b1726b261098c8e7a3cabbe793567ee642d5
git-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: bb403256ea03efa30cbd2627706e95574c80ec1c0b132a729148885b376e31f8
git-debugsource-2.18.4-3.el8_2.x86_64.rpm SHA-256: cbd38afc69c298fff22a84bd51d73db4d32a0ae2a1e1e13727891508e6c8491e
git-email-2.18.4-3.el8_2.noarch.rpm SHA-256: 725f9dd78deb873fdb4db718abccf4c4b54f0fd25596aca53c0394a9f99acda6
git-gui-2.18.4-3.el8_2.noarch.rpm SHA-256: 532761abf0dc486c8d72870523590568940211b4f4ff10444cfc5f2a456fa87c
git-instaweb-2.18.4-3.el8_2.x86_64.rpm SHA-256: 829a290f3cf272dbce94ecec4f7b3f847e18e724344b6a8997261e60d11f5835
git-subtree-2.18.4-3.el8_2.x86_64.rpm SHA-256: 30be54ca22a9205cb96658ae146abe131a613dff6a2f7c47b045a1d62d0e2666
git-svn-2.18.4-3.el8_2.x86_64.rpm SHA-256: 24ce18f609c27fe5040e392f545f9885e3c5ee182ed107bfc145fd4c4cb33dc7
git-svn-debuginfo-2.18.4-3.el8_2.x86_64.rpm SHA-256: cbfabe763ed5853e70881d83c6aab22707434de23da27ac652d9e9e6fc80d865
gitk-2.18.4-3.el8_2.noarch.rpm SHA-256: ae458d7e462126a41ea8f79cb74538404a0b5d59fe08a26a2c11ecd46ce2b951
gitweb-2.18.4-3.el8_2.noarch.rpm SHA-256: ba38d654e3e456cb54b8c4e61d61dfe7f1b9af40121490e5d532b718eb41b35f
perl-Git-2.18.4-3.el8_2.noarch.rpm SHA-256: d3c2bd64ad2c6d8a4dde3432ba4dd51874e46b8ca1d5b30994c530652eca8935
perl-Git-SVN-2.18.4-3.el8_2.noarch.rpm SHA-256: 7065efcc1dce0f5a56676346d04ce1c8c1043e93dcb362a04eda633ce26bd872

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.