Linux · Security advisory · May 24, 2023

ELSA-2023-3246: Security update for 15 packages

ELSA-2023-3246, released May 24, 2023, fixes 5 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.5188
98th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 3 Routine 2

Fixed package versions

ProductReleaseFixed in
gitol 80:2.39.3-1.el8_8
git-allol 80:2.39.3-1.el8_8
git-coreol 80:2.39.3-1.el8_8
git-core-docol 80:2.39.3-1.el8_8
git-credential-libsecretol 80:2.39.3-1.el8_8
git-daemonol 80:2.39.3-1.el8_8
git-emailol 80:2.39.3-1.el8_8
git-guiol 80:2.39.3-1.el8_8
git-instawebol 80:2.39.3-1.el8_8
git-subtreeol 80:2.39.3-1.el8_8
git-svnol 80:2.39.3-1.el8_8
gitkol 80:2.39.3-1.el8_8
gitwebol 80:2.39.3-1.el8_8
perl-Gitol 80:2.39.3-1.el8_8
perl-Git-SVNol 80:2.39.3-1.el8_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-25652 GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write 7.5 0.5188 Exploitation Less Likely
High CVE-2023-29007 GitHub: CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit` 7.8 0.0561 Exploitation Less Likely
High CVE-2023-23946 GitHub: CVE-2023-23946 mingit Remote Code Execution Vulnerability 7.5 0.0114 Exploitation Less Likely
Routine CVE-2023-25815 GitHub: CVE-2023-25815 Git looks for localized messages in an unprivileged place 2.2 0.0084 Exploitation Less Likely
Routine CVE-2023-22490 GitHub: CVE-2023-22490 mingit Information Disclosure Vulnerability 5.5 0.0071 Exploitation Less Likely
Showing 1 to 5 of 5 1