Bug 905088 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007) – <dev-vcs/git-{2.39.3, 2.40.1}: Multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2023-04-25 22:51:17 UTC]

https://lore.kernel.org/lkml/xmqqa5yv3n93.fsf@gitster.g/

"""
The addressed issues are:

 * CVE-2023-25652:

   By feeding specially crafted input to `git apply --reject`, a
   path outside the working tree can be overwritten with partially
   controlled contents (corresponding to the rejected hunk(s) from
   the given patch).

 * CVE-2023-25815:

   When Git is compiled with runtime prefix support and runs without
   translated messages, it still used the gettext machinery to
   display messages, which subsequently potentially looked for
   translated messages in unexpected places. This allowed for
   malicious placement of crafted messages.

 * CVE-2023-29007:

   When renaming or deleting a section from a configuration file,
   certain malicious configuration values may be misinterpreted as
   the beginning of a new configuration section, leading to arbitrary
   configuration injection.
"""

[Comment 1 Larry the Git Cow 2023-04-25 23:17:53 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=94633b2602d86b4d77e1dc2a148437f725cf0d55

commit 94633b2602d86b4d77e1dc2a148437f725cf0d55
Author:     Sam James <[e-mail]>
AuthorDate: 2023-04-25 23:16:58 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-04-25 23:16:58 +0000

    dev-vcs/git: add 2.40.1
    
    Bug: https://bugs.gentoo.org/905088
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.40.1.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 647 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=77a5f5ca9c11790bb0989385f30d9dff6edc7c82

commit 77a5f5ca9c11790bb0989385f30d9dff6edc7c82
Author:     Sam James <[e-mail]>
AuthorDate: 2023-04-25 22:59:51 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-04-25 22:59:51 +0000

    dev-vcs/git: add 2.39.3
    
    Bug: https://bugs.gentoo.org/905088
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.39.3.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 647 insertions(+)

[Comment 2 Hans de Graaff 2023-10-29 09:39:27 UTC]

Ping. Any reason we are still keeping git-2.39.2-r1 around?

[Comment 3 Larry the Git Cow 2023-11-01 21:05:24 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e772875e51b9a7085f89783bfbd7452272c95550

commit e772875e51b9a7085f89783bfbd7452272c95550
Author:     Robin H. Johnson <[e-mail]>
AuthorDate: 2023-11-01 21:05:17 +0000
Commit:     Robin H. Johnson <[e-mail]>
CommitDate: 2023-11-01 21:05:17 +0000

    dev-vcs/git: cleanup git-2.39.2-r1
    
    Signed-off-by: Robin H. Johnson <[e-mail]>
    Bug: https://bugs.gentoo.org/show_bug.cgi?id=905088

 dev-vcs/git/Manifest             |   3 -
 dev-vcs/git/git-2.39.2-r1.ebuild | 645 ---------------------------------------
 2 files changed, 648 deletions(-)

[Comment 4 Larry the Git Cow 2023-12-27 07:49:48 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2c2ec5453e20060d4ec1717825d2874f0e663f91

commit 2c2ec5453e20060d4ec1717825d2874f0e663f91
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-12-27 07:49:08 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2023-12-27 07:49:42 +0000

    [ GLSA 202312-15 ] Git: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/838127
    Bug: https://bugs.gentoo.org/857831
    Bug: https://bugs.gentoo.org/877565
    Bug: https://bugs.gentoo.org/891221
    Bug: https://bugs.gentoo.org/894472
    Bug: https://bugs.gentoo.org/905088
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202312-15.xml | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)