Anolis OS update for git

Published: 2023-03-01 | Updated: 2025-03-28

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-23521 CVE-2022-41903
CWE-ID	CWE-190 CWE-122
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Anolis OS Operating systems & Components / Operating system perl-Git-SVN Operating systems & Components / Operating system package or component perl-Git Operating systems & Components / Operating system package or component gitweb Operating systems & Components / Operating system package or component gitk Operating systems & Components / Operating system package or component git-p4 Operating systems & Components / Operating system package or component git-instaweb Operating systems & Components / Operating system package or component git-hg Operating systems & Components / Operating system package or component git-gui Operating systems & Components / Operating system package or component git-email Operating systems & Components / Operating system package or component git-cvs Operating systems & Components / Operating system package or component git-bzr Operating systems & Components / Operating system package or component git-all Operating systems & Components / Operating system package or component emacs-git-el Operating systems & Components / Operating system package or component emacs-git Operating systems & Components / Operating system package or component git-svn Operating systems & Components / Operating system package or component git-gnome-keyring Operating systems & Components / Operating system package or component git-daemon Operating systems & Components / Operating system package or component git Operating systems & Components / Operating system package or component
Vendor	OpenAnolis

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Integer overflow

EUVDB-ID: #VU71239

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-23521

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when parsing the .gitattributes attributes. A remote attacker can trick the victim into cloning a specially crafted repository and execute arbitrary code on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

perl-Git-SVN: before 1.8.3.1-24

perl-Git: before 1.8.3.1-24

gitweb: before 1.8.3.1-24

gitk: before 1.8.3.1-24

git-p4: before 1.8.3.1-24

git-instaweb: before 1.8.3.1-24

git-hg: before 1.8.3.1-24

git-gui: before 1.8.3.1-24

git-email: before 1.8.3.1-24

git-cvs: before 1.8.3.1-24

git-bzr: before 1.8.3.1-24

git-all: before 1.8.3.1-24

emacs-git-el: before 1.8.3.1-24

emacs-git: before 1.8.3.1-24

git-svn: before 1.8.3.1-24

git-gnome-keyring: before 1.8.3.1-24

git-daemon: before 1.8.3.1-24

git: before 1.8.3.1-24

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0067

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU71238