{"id":"CLSA-2023-1683815086","summary":"Fix CVE(s): CVE-2023-25652, CVE-2023-29007","details":"\n   * SECURITY UPDATE: By feeding specially crafted input to\n     `git apply --reject`, a path outside the working tree can be\n     overwritten with partially controlled contents (corresponding to the\n     rejected hunk(s) from the given patch)\n     - debian/patches/CVE-2023-25652.patch: removing a link instead of\n       writing into\n     - CVE-2023-25652\n   * SECURITY UPDATE: A specially crafted `.gitmodules` file with submodule\n     URLs that are longer than 1024 characters can used to exploit a bug in\n     `config.c::git_config_rename_section_in_file()` that can lead to a\n     remote code execution\n     - debian/patches/CVE-2023-29007.patch: restrict the config file line\n       length to parse it whole either as a section or as a parameter\n     - CVE-2023-29007","modified":"2026-06-04T09:45:52.991766926Z","published":"2023-05-11T14:24:53Z","upstream":["CVE-2023-25652","CVE-2023-29007"],"references":[{"type":"ADVISORY","url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1683815086"}],"affected":[{"package":{"name":"git","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-all","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-all?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-arch","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-arch?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-core","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-core?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-cvs","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-cvs?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-daemon-run","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-daemon-run?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-daemon-sysvinit","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-daemon-sysvinit?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-el","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-el?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-email","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-email?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-gui","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-gui?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-man","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-man?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-mediawiki","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-mediawiki?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"git-svn","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/git-svn?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"gitk","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/gitk?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}},{"package":{"name":"gitweb","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/gitweb?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2023-1683815086.json"}}],"schema_version":"1.7.5"}