Insufficient verification of data authenticity in Git for Windows - CVE-2023-25815

Vulnerability identifier: #VU75485

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25815

CWE-ID: CWE-345

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to tamper with Git messages.

The vulnerability exists due to the way Git processes localized messages. A local user on a multi-user machine can display a malicious message to the user.

Git for Windows
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
cflinuxfs3
OpenManage Network Integration (OMNI)
Platform Automation Toolkit
Debian Linux
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
HPE Helion Openstack
SUSE OpenStack Cloud
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
Slackware Linux
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Logging
Isolation Segment
VMware Tanzu Application Service for VMs
OpenShift Developer Tools and Services
Visual Studio
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
git (Ubuntu package)
git (Red Hat package)
git-gui
gitk
git-core
git-email
git-daemon
git-daemon-debuginfo
git-web
git-core-debuginfo
git-svn
git-svn-debuginfo
git-arch
git-doc
git-debugsource
git
git-cvs
git-debuginfo
rh-git227-git (Red Hat package)
perl-Git-SVN
perl-Git
git-help
git-p4
git-credential-gnome-keyring
git-credential-libsecret-debuginfo
git-credential-libsecret
git-credential-gnome-keyring-debuginfo
dev-vcs/git
git-subtree
git-all
git-core-doc
gitweb
git-instaweb
git (Debian package)
VMware Tanzu Operations Manager
Dell EMC NetWorker vProxy

Install updates from vendor's website.

Git for Windows - addressed in versions 2.39.3.1, 2.40.1.1
Migration Toolkit for Containers - update to 1.7.10
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.9, 2.6.6, 2.7.4
Red Hat OpenShift Container Platform - addressed in versions 4.10.61, 4.11.42, 4.12.19, 4.12.20, 4.13.1, 4.13.2
OpenShift Logging - update to 5.7.2
git (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.17.1-1ubuntu0.18, 1:2.25.1-1ubuntu3.11, 1:2.34.1-1ubuntu1.9, 1:2.37.2-1ubuntu1.5, 1:2.39.2-1ubuntu1.1
cflinuxfs3 - update to 0.365.0
Isolation Segment - addressed in versions 2.11.33, 2.13.18, 3.0.11, 4.0.2
VMware Tanzu Application Service for VMs - addressed in versions 2.11.39, 2.13.21, 3.0.11, 4.0.2
git (Red Hat package) - addressed in versions 2.18.4-3.el8_1, 2.18.4-4.el8_2, 2.27.0-4.el8_4, 2.31.1-4.el8_6, 2.31.1-5.el9_0, 2.39.3-1.el8_8, 2.39.3-1.el9_2
git-gui - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
gitk - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-core - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-email - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-daemon - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-daemon-debuginfo - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-web - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-core-debuginfo - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-svn - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-svn-debuginfo - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1
git-arch - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-doc - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-debugsource - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-cvs - addressed in versions 2.26.2-27.69.1, 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
git-debuginfo - addressed in versions 2.26.2-150000.50.1, 2.35.3-150300.10.27.1
rh-git227-git (Red Hat package) - update to 2.27.0-6.el7
git - update to 2.27.0-14
git-debugsource - update to 2.27.0-14
git-daemon - update to 2.27.0-14
git-debuginfo - update to 2.27.0-14
perl-Git-SVN - update to 2.27.0-14
git-gui - update to 2.27.0-14
perl-Git - update to 2.27.0-14
git-email - update to 2.27.0-14
git-web - update to 2.27.0-14
gitk - update to 2.27.0-14
git-help - update to 2.27.0-14
git-svn - update to 2.27.0-14
git - addressed in versions 2.30.9, 2.35.8
git-p4 - update to 2.35.3-150300.10.27.1
perl-Git - update to 2.35.3-150300.10.27.1
git-credential-gnome-keyring - update to 2.35.3-150300.10.27.1
git-credential-libsecret-debuginfo - update to 2.35.3-150300.10.27.1
git-credential-libsecret - update to 2.35.3-150300.10.27.1
git-credential-gnome-keyring-debuginfo - update to 2.35.3-150300.10.27.1
dev-vcs/git - update to 2.39.3
perl-Git-SVN - update to 2.39.3-1.0.1
git - update to 2.39.3-1.0.1
git-core - update to 2.39.3-1.0.1
git-credential-libsecret - update to 2.39.3-1.0.1
git-daemon - update to 2.39.3-1.0.1
git-subtree - update to 2.39.3-1.0.1
git-all - update to 2.39.3-1.0.1
git-core-doc - update to 2.39.3-1.0.1
git-email - update to 2.39.3-1.0.1
git-gui - update to 2.39.3-1.0.1
git-svn - update to 2.39.3-1.0.1
perl-Git - update to 2.39.3-1.0.1
gitweb - update to 2.39.3-1.0.1
gitk - update to 2.39.3-1.0.1
git-instaweb - update to 2.39.3-1.0.1
git (Debian package) - update to 1:2.39.5-0+deb12u1
git - addressed in versions 2.40.1-1.fc36, 2.40.1-1.fc37, 2.40.1-1.fc38
VMware Tanzu Operations Manager - update to 3.0.9
OpenManage Network Integration (OMNI) - update to 3.7
Platform Automation Toolkit - addressed in versions 4.4.31, 5.0.24, 5.1.1
Visual Studio - addressed in versions 16.11.27 16.11.33801.447, 17.0.22 17.0.33801.228, 17.2.16 17.2.33801.349, 17.4.8 17.4.33801.306, 17.6.3 17.6.33801.468, 2017 version 15.9.55
Dell EMC NetWorker vProxy - addressed in versions 19.8.0.3, 19.9.0.2

• https://github.com/git-for-windows/git/releases/tag/v2.39.3.windows.1
• https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
• https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8

• Multiple vulnerabilities in Git for Windows
• Slackware Linux update for git
• SUSE update for git
• SUSE update for git
• Ubuntu update for git
• SUSE update for git
• SUSE update for git
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for git
• Red Hat Enterprise Linux 9.0 Extended Update Support update for git
• Red Hat Enterprise Linux 8.6 Extended Update Support update for git
• Red Hat Enterprise Linux 8 update for git
• Red Hat Enterprise Linux 9 update for git
• Red Hat Enterprise Linux 8.4 Extended Update Support update for git
• Red Hat Software Collections update for rh-git227-git
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.6
• Red Hat Enterprise Linux 8.2 Advanced Update Support update for git
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.5
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• OpenShift Container Platform 4.12 update for golang
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.7
• Microsoft Visual Studio update for GitHub
• Migration Toolkit for Containers (MTC) 1.7 update for golang
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.11
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.12
• VMware Tanzu products update for Git
• Multiple vulnerabilities in Dell Data Protection Central
• Fedora 37 update for git
• Fedora 38 update for git
• Fedora 36 update for git
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Multiple vulnerabilities in Dell NetWorker vProxy
• Gentoo update for Git
• openEuler update for git
• Debian update for git
• Ubuntu update for git
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• Anolis OS update for git