Linux · Security advisory · May 23, 2023

ELSA-2023-2859: Security update for 15 packages

ELSA-2023-2859, released May 23, 2023, fixes 4 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0399
90th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
gitol 80:2.39.1-1.el8
git-allol 80:2.39.1-1.el8
git-coreol 80:2.39.1-1.el8
git-core-docol 80:2.39.1-1.el8
git-credential-libsecretol 80:2.39.1-1.el8
git-daemonol 80:2.39.1-1.el8
git-emailol 80:2.39.1-1.el8
git-guiol 80:2.39.1-1.el8
git-instawebol 80:2.39.1-1.el8
git-subtreeol 80:2.39.1-1.el8
git-svnol 80:2.39.1-1.el8
gitkol 80:2.39.1-1.el8
gitwebol 80:2.39.1-1.el8
perl-Gitol 80:2.39.1-1.el8
perl-Git-SVNol 80:2.39.1-1.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-39260 git: Git is a distributed revision control system with a decentralized architecture 8.8 0.0399 None reported
High CVE-2022-24765 GitHub: Uncontrolled search for the Git directory in Git for Windows 7.8 0.0101 Exploitation Less Likely
High CVE-2022-29187 Bypass of safe.directory protections in Git 7.8 0.0045 None reported
Routine CVE-2022-39253 GitHub: CVE-2022-39253 Local clone optimization dereferences symbolic links by default 5.5 0.0148 Exploitation Less Likely
Showing 1 to 4 of 4 1