Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`. https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76 https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem
Created git tracking bugs for this issue: Affects: fedora-36 [bug 2162065] Affects: fedora-37 [bug 2162066]
Hello there, If it's not the correct location for this comment, please redirect me to a better place ;-) Do you have any ETA about the availability of the fix in the affected lines of your Docker images? UBI 7-9 are affected since more than 2 weeks, usually you are providing the corrections in a very reactive (and appreciated) way, making this one a bit weird (along with CVE-2022-23521). Also I saw that the score was moving from Critical to High and now back to Critical. In the meantime, do you have a workaround recommendation? Wadeck
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2023:0597 https://access.redhat.com/errata/RHSA-2023:0597
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2023:0596 https://access.redhat.com/errata/RHSA-2023:0596
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2023:0599 https://access.redhat.com/errata/RHSA-2023:0599
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2023:0609 https://access.redhat.com/errata/RHSA-2023:0609
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:0611 https://access.redhat.com/errata/RHSA-2023:0611
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:0610 https://access.redhat.com/errata/RHSA-2023:0610
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:0627 https://access.redhat.com/errata/RHSA-2023:0627
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:0628 https://access.redhat.com/errata/RHSA-2023:0628
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-41903
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2023:0978 https://access.redhat.com/errata/RHSA-2023:0978
This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2023:1677 https://access.redhat.com/errata/RHSA-2023:1677