Link following in JGit - CVE-2023-4759

Vulnerability identifier: #VU81948

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4759

CWE-ID: CWE-59

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to overwrite files on the system.

The vulnerability exists due to an insecure link following. A remote attacker can place a specially crafted symbolic link into the repository, trick the victim into cloning it and overwrite arbitrary files on the system.

JGit
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Server Module
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
openSUSE Leap
openEuler
JBoss Enterprise Application Platform
Wildfly Core
IBM Business Automation Manager Open Editions
DevOps Test Embedded for Eclipse
Oracle Data Integrator
Cloud Pak for Network Automation
Bamboo Server
IBM Cloud Transformation Advisor
IBM Decision Optimization for Cloud Pak for Data
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
IBM Observability with Instana
Oracle Global Lifecycle Management NextGen OUI Framework
jsch-demo
jsch-javadoc
jsch
eap7-wildfly-naming-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap7-log4j2-jboss-logmanager (Red Hat package)
eap8-parsson (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-jboss-msc (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-glassfish-jsf (Red Hat package)
eap8-apache-sshd (Red Hat package)
eap8-log4j (Red Hat package)
eap7-jbossws-spi (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-protostream (Red Hat package)
eap7-hibernate (Red Hat package)
jgit-javadoc
jgit
eclipse-jgit
eap7-eclipse-jgit (Red Hat package)
eap8-eclipse-jgit (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-lucene-solr (Red Hat package)
IBM Cloud Pak System
IBM InfoSphere Information Server

Install updates from vendor's website.

JGit - update to 6.6.1.202309021850-r
JBoss Enterprise Application Platform - addressed in versions 7.4.15, 8.0.1
IBM Business Automation Manager Open Editions - update to 8.0.6
Bamboo Server - addressed in versions 9.2.14, 9.4.4, 9.5.2
Wildfly Core - update to 22.0.0
jsch-demo - update to 0.2.9-150200.11.10.1
jsch-javadoc - update to 0.2.9-150200.11.10.1
jsch - update to 0.2.9-150200.11.10.1
eap7-wildfly-naming-client (Red Hat package) - addressed in versions 1.0.17-1.Final_redhat_00001.1.el7eap, 1.0.17-1.Final_redhat_00001.1.el8eap, 1.0.17-1.Final_redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.1-1.redhat_00001.1.el7eap, 1.1.1-1.redhat_00001.1.el8eap, 1.1.1-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.1-1.redhat_00001.1.el7eap, 1.1.1-1.redhat_00001.1.el8eap, 1.1.1-1.redhat_00001.1.el9eap
eap7-log4j2-jboss-logmanager (Red Hat package) - addressed in versions 1.1.2-1.Final_redhat_00002.1.el7eap, 1.1.2-1.Final_redhat_00002.1.el8eap, 1.1.2-1.Final_redhat_00002.1.el9eap
eap8-parsson (Red Hat package) - addressed in versions 1.1.5-1.redhat_00001.1.el8eap, 1.1.5-1.redhat_00001.1.el9eap
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.17-1.Final_redhat_00001.1.el7eap, 1.1.17-1.Final_redhat_00001.1.el8eap, 1.1.17-1.Final_redhat_00001.1.el9eap
eap7-jboss-msc (Red Hat package) - addressed in versions 1.4.13-1.Final_redhat_00001.1.el7eap, 1.4.13-1.Final_redhat_00001.1.el8eap, 1.4.13-1.Final_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.16-1.Final_redhat_00001.1.el7eap, 1.5.16-1.Final_redhat_00001.1.el8eap, 1.5.16-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-34.Final_redhat_00033.1.el7eap, 1.10.0-34.Final_redhat_00033.1.el8eap, 1.10.0-34.Final_redhat_00033.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.21-1.Final_redhat_00001.1.el7eap, 1.15.21-1.Final_redhat_00001.1.el8eap, 1.15.21-1.Final_redhat_00001.1.el9eap
eap7-xml-security (Red Hat package) - addressed in versions 2.2.6-1.redhat_00002.1.el7eap, 2.2.6-1.redhat_00002.1.el8eap, 2.2.6-1.redhat_00002.1.el9eap
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-7.SP08_redhat_00001.1.el7eap, 2.3.14-7.SP08_redhat_00001.1.el8eap, 2.3.14-7.SP08_redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.6.4
eap8-apache-sshd (Red Hat package) - addressed in versions 2.12.0-1.redhat_00001.1.el8eap, 2.12.0-1.redhat_00001.1.el9eap
eap8-log4j (Red Hat package) - addressed in versions 2.19.0-2.redhat_00001.1.el8eap, 2.19.0-2.redhat_00001.1.el9eap
eap7-jbossws-spi (Red Hat package) - addressed in versions 3.4.0-4.Final_redhat_00002.1.el7eap, 3.4.0-4.Final_redhat_00002.1.el8eap, 3.4.0-4.Final_redhat_00002.1.el9eap
IBM Cloud Transformation Advisor - update to 3.7.1
eap7-resteasy (Red Hat package) - addressed in versions 3.15.9-1.Final_redhat_00001.1.el7eap, 3.15.9-1.Final_redhat_00001.1.el8eap, 3.15.9-1.Final_redhat_00001.1.el9eap
eap7-protostream (Red Hat package) - addressed in versions 4.3.6-1.Final_redhat_00001.1.el7eap, 4.3.6-1.Final_redhat_00001.1.el8eap, 4.3.6-1.Final_redhat_00001.1.el9eap
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
eap7-hibernate (Red Hat package) - addressed in versions 5.3.33-2.Final_redhat_00001.1.el7eap, 5.3.33-2.Final_redhat_00001.1.el8eap, 5.3.33-2.Final_redhat_00001.1.el9eap
jgit-javadoc - update to 5.11.0-3
jgit - update to 5.11.0-3
jgit-javadoc - update to 5.11.0-150200.3.15.2
eclipse-jgit - update to 5.11.0-150200.3.15.2
jgit - update to 5.11.0-150200.3.15.2
eap7-eclipse-jgit (Red Hat package) - addressed in versions 5.13.2-1.SP1_redhat_00001.1.el7eap, 5.13.2-1.SP1_redhat_00001.1.el8eap, 5.13.2-1.SP1_redhat_00001.1.el9eap
eap8-eclipse-jgit (Red Hat package) - addressed in versions 6.6.1.202309021850-1.r_redhat_00001.1.el8eap, 6.6.1.202309021850-1.r_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.15-2.GA_redhat_00002.1.el7eap, 7.4.15-2.GA_redhat_00002.1.el8eap, 7.4.15-2.GA_redhat_00002.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.1-3.GA_redhat_00002.1.el8eap, 8.0.1-3.GA_redhat_00002.1.el9eap
eap8-lucene-solr (Red Hat package) - addressed in versions 8.11.2-2.redhat_00001.1.el8eap, 8.11.2-2.redhat_00001.1.el9eap
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.29, 23.0.2.1
IBM Automation Decision Services - update to 23.0.2.0.1
IBM Observability with Instana - update to 271

• https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1
• https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11

• Insecure link following in Eclipse JGit
• Multiple vulnerabilities in Wildfly Core
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Link following in IBM Cloud Pak System
• SUSE update for eclipse-jgit, jsch
• Link following in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• openEuler update for jgit
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Bamboo Data Center and Server update for Eclipse JGit
• Link following in IBM InfoSphere Information Server
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• Multiple vulnerabilities in Oracle Data Integrator
• IBM Business Automation Manager Open Editions update for Eclipse JGit
• Multiple vulnerabilities in IBM DevOps Test Embedded for Eclipse