Linux · Security advisory · May 16, 2023

RHSA-2023:2859: Security update for 15 packages

RHSA-2023:2859, released May 16, 2023, fixes 4 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0399
90th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
gitRHEL 80:2.39.1-1.el8
git-allRHEL 80:2.39.1-1.el8
git-coreRHEL 80:2.39.1-1.el8
git-core-docRHEL 80:2.39.1-1.el8
git-credential-libsecretRHEL 80:2.39.1-1.el8
git-daemonRHEL 80:2.39.1-1.el8
git-emailRHEL 80:2.39.1-1.el8
git-guiRHEL 80:2.39.1-1.el8
git-instawebRHEL 80:2.39.1-1.el8
git-subtreeRHEL 80:2.39.1-1.el8
git-svnRHEL 80:2.39.1-1.el8
gitkRHEL 80:2.39.1-1.el8
gitwebRHEL 80:2.39.1-1.el8
perl-GitRHEL 80:2.39.1-1.el8
perl-Git-SVNRHEL 80:2.39.1-1.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-39260 git: Git is a distributed revision control system with a decentralized architecture 8.8 0.0399 None reported
High CVE-2022-24765 GitHub: Uncontrolled search for the Git directory in Git for Windows 7.8 0.0101 Exploitation Less Likely
High CVE-2022-29187 Bypass of safe.directory protections in Git 7.8 0.0045 None reported
Routine CVE-2022-39253 GitHub: CVE-2022-39253 Local clone optimization dereferences symbolic links by default 5.5 0.0148 Exploitation Less Likely
Showing 1 to 4 of 4 1