The maintainers of the Git source code version control system have released updates to remediate two critical vulnerabilities that malicious actors could exploit to remotely execute code.
defects tracked as CVE-2022-23521 When CVE-2022-41903affects the following versions of Git: v2.30.6, v2.31.5, v2.32.4, v2.33.5, v2.34.5, v2.35.5, v2.36.3, v2.37.4, v2.38.2, and v2 .39.0.
Patched versions include v2.30.7, v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, v2.38.3, and v2.39.1. included. X41 D-Sec security researchers Markus Vervier and Eric Sesterhenn and his GitLab’s Joern Schneeweisz allegedly reported the bug.
“The most severe issue discovered allows an attacker to trigger heap-based memory corruption during clone or pull operations, potentially resulting in code execution,” German cybersecurity firm CVE-2022- It says about 23521.
Another critical vulnerability, CVE-2022-41903, is triggered during archive operations and causes code execution due to an integer overflow flaw in formatting the commit log.
X41 D-Sec added, “In addition, we identified a huge number of integer-related issues. It may lead to proper processing.”
No workaround for CVE-2022-23521, but Git disables “git archives” on untrusted repositories as a mitigation for CVE-2022-41903 in scenarios where updating to the latest version is not an option We recommend that users
GitLab said in a coordinated advisory that it has released versions 15.7.5, 15.6.6, and 15.5.9 of GitLab Community Edition (CE) and Enterprise Edition (EE) to address the shortcomings, and will immediately notify customers Prompted me to apply the fix. effect.
