Linux · Security advisory · September 13, 2024

DSA-5769-1: git security update

DSA-5769-1, released September 13, 2024, fixes 1 CVE in git (version 1:2.39.5-0+deb12u1). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.5188

98th percentile

Fixed package versions

Product	Release	Fixed in
git	Debian 12.15 (bookworm)	1:2.39.5-0+deb12u1

CVEs this fix closes

Priority	CVE	Title	Impact	CVSS	EPSS	Exploitation
High	CVE-2023-25652	GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write		7.5	0.5188	Exploitation Less Likely

Also fixes CVE-2023-25652

RLSA-2023:3246
git on rocky 8
ELSA-2023-3246
git, git-all, git-core and 12 more on ol 8
ELSA-2023-3245
git, git-all, git-core and 12 more on ol 9
ALSA-2023:3245
git, git-all, git-core and 12 more on almalinux 9
ALSA-2023:3246
git, git-all, git-core and 12 more on almalinux 8
RHSA-2023:3245
git, git-all, git-core and 12 more on RHEL 9
RHSA-2023:3246
git, git-all, git-core and 12 more on RHEL 8
git 1:2.17.1-1ubuntu0.18
git on Ubuntu 18.04.6 LTS (bionic)

Vendor advisory

https://security-tracker.debian.org/tracker/CVE-2023-25652

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo