Linux · Security advisory · May 22, 2023

RHSA-2023:3245: Security update for 15 packages

RHSA-2023:3245, released May 22, 2023, fixes 5 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.5188
98th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 3 Routine 2

Fixed package versions

ProductReleaseFixed in
gitRHEL 90:2.39.3-1.el9_2
git-allRHEL 90:2.39.3-1.el9_2
git-coreRHEL 90:2.39.3-1.el9_2
git-core-docRHEL 90:2.39.3-1.el9_2
git-credential-libsecretRHEL 90:2.39.3-1.el9_2
git-daemonRHEL 90:2.39.3-1.el9_2
git-emailRHEL 90:2.39.3-1.el9_2
git-guiRHEL 90:2.39.3-1.el9_2
git-instawebRHEL 90:2.39.3-1.el9_2
git-subtreeRHEL 90:2.39.3-1.el9_2
git-svnRHEL 90:2.39.3-1.el9_2
gitkRHEL 90:2.39.3-1.el9_2
gitwebRHEL 90:2.39.3-1.el9_2
perl-GitRHEL 90:2.39.3-1.el9_2
perl-Git-SVNRHEL 90:2.39.3-1.el9_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-25652 GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write 7.5 0.5188 Exploitation Less Likely
High CVE-2023-29007 GitHub: CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit` 7.8 0.0561 Exploitation Less Likely
High CVE-2023-23946 GitHub: CVE-2023-23946 mingit Remote Code Execution Vulnerability 7.5 0.0114 Exploitation Less Likely
Routine CVE-2023-25815 GitHub: CVE-2023-25815 Git looks for localized messages in an unprivileged place 2.2 0.0084 Exploitation Less Likely
Routine CVE-2023-22490 GitHub: CVE-2023-22490 mingit Information Disclosure Vulnerability 5.5 0.0071 Exploitation Less Likely
Showing 1 to 5 of 5 1