Link following in Git - CVE-2023-22490

Vulnerability identifier: #VU72246

CSH Severity: Low

CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22490

CWE-ID: CWE-59

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insecure processing of symbolic links when using local clone optimization. Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, however the `objects` directory itself may still be a symbolic link. A remote attacker can trick the victim into using the local clone optimization to exfiltrate arbitrary files from the victim's system.

Git
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
Ubuntu
openEuler
Fedora
ObjectScale
Git for Windows
EMC ECS
cflinuxfs3
Platform Automation Toolkit
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Logging
Isolation Segment
VMware Tanzu Application Service for VMs
OpenShift Developer Tools and Services
Visual Studio
git (Ubuntu package)
git-doc
git-svn-debuginfo
git-arch
gitk
git-web
git-svn
git-gui
git-email
git-debugsource
git-daemon-debuginfo
git-daemon
git-cvs
git-core-debuginfo
git-core
git
git-debuginfo
perl-Git-SVN
git-help
perl-Git
git (Debian package)
git-credential-libsecret-debuginfo
git-credential-libsecret
git-p4
git-credential-gnome-keyring-debuginfo
git-credential-gnome-keyring
dev-vcs/git
git (Red Hat package)
git-subtree
git-all
git-core-doc
git-instaweb
gitweb

Install updates from vendor's website.

Git - addressed in versions 2.30.8, 2.31.7, 2.32.6, 2.33.7, 2.34.7, 2.35.7, 2.36.5, 2.37.6, 2.38.4, 2.39.2
ObjectScale - update to 1.3.0
Migration Toolkit for Containers - update to 1.7.10
Git for Windows - addressed in versions 2.35.7.1, 2.39.2.1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.9, 2.6.6, 2.7.4
EMC ECS - update to 3.7.0.6
Red Hat OpenShift Container Platform - update to 4.13.2
OpenShift Logging - update to 5.7.2
git (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.17.1-1ubuntu0.16, 1:2.17.1-1ubuntu0.17, 1:2.25.1-1ubuntu3.10, 1:2.34.1-1ubuntu1.8, 1:2.37.2-1ubuntu1.4
cflinuxfs3 - addressed in versions 0.352.0, 0.354.0
Isolation Segment - addressed in versions 2.11.30, 2.12.20, 2.13.15, 3.0.8, 4.0.0
VMware Tanzu Application Service for VMs - addressed in versions 2.11.36, 2.12.25, 2.13.18, 3.0.8, 4.0.0
git-doc - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-svn-debuginfo - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1
git-arch - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
gitk - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-web - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-svn - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-gui - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-email - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-debugsource - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-daemon-debuginfo - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-daemon - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-cvs - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-core-debuginfo - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-core - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git - addressed in versions 2.26.2-27.66.1, 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-debuginfo - addressed in versions 2.26.2-150000.47.1, 2.35.3-150300.10.24.1
git-svn - update to 2.27.0-12
perl-Git-SVN - update to 2.27.0-12
git-help - update to 2.27.0-12
git - update to 2.27.0-12
git-debugsource - update to 2.27.0-12
git-debuginfo - update to 2.27.0-12
git-daemon - update to 2.27.0-12
perl-Git - update to 2.27.0-12
git-web - update to 2.27.0-12
gitk - update to 2.27.0-12
git-email - update to 2.27.0-12
git-gui - update to 2.27.0-12
git (Debian package) - update to 1:2.30.2-1+deb11u2
git - addressed in versions 2.30.8, 2.35.7
git-credential-libsecret-debuginfo - update to 2.35.3-150300.10.24.1
git-credential-libsecret - update to 2.35.3-150300.10.24.1
git-p4 - update to 2.35.3-150300.10.24.1
git-credential-gnome-keyring-debuginfo - update to 2.35.3-150300.10.24.1
git-credential-gnome-keyring - update to 2.35.3-150300.10.24.1
perl-Git - update to 2.35.3-150300.10.24.1
git - addressed in versions 2.38.4-1.80, 2.39.2-1
git - addressed in versions 2.39.2-1.fc36, 2.39.2-1.fc37
dev-vcs/git - update to 2.39.3
git (Red Hat package) - addressed in versions 2.39.3-1.el8_8, 2.39.3-1.el9_2
git-email - update to 2.39.3-1.0.1
git-daemon - update to 2.39.3-1.0.1
git-credential-libsecret - update to 2.39.3-1.0.1
git-core - update to 2.39.3-1.0.1
git - update to 2.39.3-1.0.1
git-subtree - update to 2.39.3-1.0.1
git-all - update to 2.39.3-1.0.1
git-core-doc - update to 2.39.3-1.0.1
git-gui - update to 2.39.3-1.0.1
git-instaweb - update to 2.39.3-1.0.1
git-svn - update to 2.39.3-1.0.1
gitk - update to 2.39.3-1.0.1
gitweb - update to 2.39.3-1.0.1
perl-Git - update to 2.39.3-1.0.1
perl-Git-SVN - update to 2.39.3-1.0.1
Platform Automation Toolkit - addressed in versions 4.4.31, 5.0.24, 5.1.0, 5.1.1

• https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd
• https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q

• Multiple vulnerabilities in Git
• Multiple vulnerabilities in Git for Windows
• Ubuntu update for git
• SUSE update for git
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• Slackware Linux update for git
• SUSE update for git
• SUSE update for git
• Debian update for git
• Ubuntu update for git
• Cloud Foundry Foundation cflinuxfs3 update for Git
• Amazon Linux AMI update for git
• Information disclosure in Microsoft mingit
• Multiple vulnerabilities in Oracle Solaris third-party software
• Red Hat Enterprise Linux 8 update for git
• Red Hat Enterprise Linux 9 update for git
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.6
• VMware Tanzu Platform Automation Toolkit update for Git
• VMware Tanzu products update for Git
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.5
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.7
• Migration Toolkit for Containers (MTC) 1.7 update for golang
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.11
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.12
• Multiple vulnerabilities in Dell ECS
• Fedora 36 update for git
• Fedora 37 update for git
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Gentoo update for Git
• openEuler update for git
• Amazon Linux AMI update for git
• Anolis OS update for git
• Multiple vulnerabilities in Dell ObjectScale