Linux · Security advisory · February 6, 2023

RLSA-2023:0611: git security update

RLSA-2023:0611, released February 6, 2023, fixes 2 CVEs in git (version 0:2.31.1-3.el9_1). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.5633

99th percentile

Priority of the 2 CVEs

Patch now 0
                                Urgent 0
                                High 2
                                Routine 0

Fixed package versions

Product	Release	Fixed in
git	rocky 9	0:2.31.1-3.el9_1

CVEs this fix closes

Priority	CVE	Title	Impact	CVSS	EPSS	Exploitation
High	CVE-2022-23521	GitHub: CVE-2022-23521 gitattributes parsing integer overflow		9.8	0.5633	Exploitation Less Likely
High	CVE-2022-41903	Integer overflow in `git archive`, `git log --format` leading to RCE in git		9.8	0.4427	None reported

Also fixes CVE-2022-23521

ALAS2023-2023-065
git, git-all, git-core and 19 more on amzn 2023
ELSA-2023-0610
git, git-all, git-core and 12 more on ol 8
ELSA-2023-0611
git, git-all, git-core and 12 more on ol 9
RLSA-2023:0610
git on rocky 8
ALSA-2023:0610
git, git-all, git-core and 12 more on almalinux 8
ALSA-2023:0611
git, git-all, git-core and 12 more on almalinux 9
RHSA-2023:0610
git, git-all, git-core and 12 more on RHEL 8
RHSA-2023:0611
git, git-all, git-core and 12 more on RHEL 9

Vendor advisory

https://errata.rockylinux.org/RLSA-2023:0611

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo