USN-5810-1: Git vulnerabilities

Releases

• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• git - fast, scalable, distributed revision control system

Details

Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain
gitattributes. An attacker could possibly use this issue to cause a crash
or execute arbitrary code. (CVE-2022-23521)

Joern Schneeweisz discovered that Git incorrectly handled certain commands.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-41903)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.10

• git - 1:2.37.2-1ubuntu1.2

Ubuntu 22.04

• git - 1:2.34.1-1ubuntu1.6

Ubuntu 20.04

• git - 1:2.25.1-1ubuntu3.7

Ubuntu 18.04

• git - 1:2.17.1-1ubuntu0.14

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-41903
• CVE-2022-23521

Related notices

• USN-5810-3: git-el, git-cvs, git-all, git-arch, gitweb, git-daemon-sysvinit, git-email, gitk, git, git-man, git-doc, git-gui, git-daemon-run, git-mediawiki, git-svn, git-core
• USN-5810-4: git-el, git-cvs, git-bzr, git-all, git-arch, gitweb, git-daemon-sysvinit, git-email, gitk, git, git-man, git-doc, git-gui, git-daemon-run, git-mediawiki, git-svn, git-core