REDHAT-BUG-2168160: Medium severity git vulnerability
Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GITDIR/objects directory contains symbolic links (c.f., CVE-2022-39253), the objects directory itself may still be a symbolic link.
These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2168160?
The severity of REDHAT-BUG-2168160 is categorized as moderate.
How do I fix REDHAT-BUG-2168160?
To fix REDHAT-BUG-2168160, update Git to the latest version provided by your distribution.
What are the potential risks associated with REDHAT-BUG-2168160?
The risks associated with REDHAT-BUG-2168160 include unauthorized access to repositories due to improper handling of symbolic links.
Which versions of Git are affected by REDHAT-BUG-2168160?
Currently, REDHAT-BUG-2168160 affects multiple versions of Git prior to the patch release.
Is mitigation available for REDHAT-BUG-2168160?
Yes, applying the latest security updates provided by your Linux distribution will mitigate this vulnerability.