Linux · Security advisory · May 15, 2023

ELSA-2023-2319: Security update for 15 packages

ELSA-2023-2319, released May 15, 2023, fixes 4 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0399
90th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
gitol 90:2.39.1-1.el9
git-allol 90:2.39.1-1.el9
git-coreol 90:2.39.1-1.el9
git-core-docol 90:2.39.1-1.el9
git-credential-libsecretol 90:2.39.1-1.el9
git-daemonol 90:2.39.1-1.el9
git-emailol 90:2.39.1-1.el9
git-guiol 90:2.39.1-1.el9
git-instawebol 90:2.39.1-1.el9
git-subtreeol 90:2.39.1-1.el9
git-svnol 90:2.39.1-1.el9
gitkol 90:2.39.1-1.el9
gitwebol 90:2.39.1-1.el9
perl-Gitol 90:2.39.1-1.el9
perl-Git-SVNol 90:2.39.1-1.el9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-39260 git: Git is a distributed revision control system with a decentralized architecture 8.8 0.0399 None reported
High CVE-2022-24765 GitHub: Uncontrolled search for the Git directory in Git for Windows 7.8 0.0101 Exploitation Less Likely
High CVE-2022-29187 Bypass of safe.directory protections in Git 7.8 0.0045 None reported
Routine CVE-2022-39253 GitHub: CVE-2022-39253 Local clone optimization dereferences symbolic links by default 5.5 0.0148 Exploitation Less Likely
Showing 1 to 4 of 4 1