Ubuntu Security Notice 5686-1 - Cory Snider discovered that Git incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause an unexpected behaviour. Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could possibly use this issue to arbitrary code execution.
c699a9bd555fb4922c18021b0fbfc11f65ddedf4fd6d1d4bb837d79ba1110921
=========================================================================
Ubuntu Security Notice USN-5686-1
October 18, 2022
git vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Git.
Software Description:
- git: fast, scalable, distributed revision control system
Details:
Cory Snider discovered that Git incorrectly handled certain symbolic links.
An attacker could possibly use this issue to cause an unexpected behaviour.
(CVE-2022-39253)
Kevin Backhouse discovered that Git incorrectly handled certain command strings.
An attacker could possibly use this issue to arbitrary code execution.
(CVE-2022-39260)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
git 1:2.34.1-1ubuntu1.5
Ubuntu 20.04 LTS:
git 1:2.25.1-1ubuntu3.6
Ubuntu 18.04 LTS:
git 1:2.17.1-1ubuntu0.13
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5686-1
CVE-2022-39253, CVE-2022-39260
Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.34.1-1ubuntu1.5
https://launchpad.net/ubuntu/+source/git/1:2.25.1-1ubuntu3.6
https://launchpad.net/ubuntu/+source/git/1:2.17.1-1ubuntu0.13