SB20241210116 - Fedora 42 update for gh



SB20241210116 - Fedora 42 update for gh

Published: December 10, 2024

Security Bulletin ID SB20241210116
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2024-24789)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate data.

The vulnerability exists due to insufficient validation of user-supplied input in archive/zip when handling zip archives. A remote attacker can create a zip file with content that will vary depending on the implementation reading the file.


2) Information disclosure (CVE-ID: CVE-2024-53858)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the application can leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. A remote attacker can trick the victim into cloning a specially crafted repository and obtain victim's authentication tokens. 


3) Path traversal (CVE-ID: CVE-2024-54132)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences within the "gh run download" command when downloading GitHub Actions workflow artifact. A remote attacker can trick the victim into downloading a specially crafted GitHub Actions workflow artifact and overwrite arbitrary files on the system, leading to potential remote code execution.


Remediation

Install update from vendor's website.