Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0163
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0163)
Summary:	The remote host is missing an update for the 'git' package(s) announced via the MGASA-2023-0163 advisory.
Description:	Summary: The remote host is missing an update for the 'git' package(s) announced via the MGASA-2023-0163 advisory. Vulnerability Insight: By feeding specially crafted input to 'git apply --reject', a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch. (CVE-2023-25652). When Git is compiled with runtime prefix support and runs without translated messages, it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages (CVE-2023-25815). When renaming or deleting a section from a configuration file, certain malicious configuration values may be misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection (CVE-2023-29007). Affected Software/OS: 'git' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-25652 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/ https://security.gentoo.org/glsa/202312-15 https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902 https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx http://www.openwall.com/lists/oss-security/2023/04/25/2 Common Vulnerability Exposure (CVE) ID: CVE-2023-25815 https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1 https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8 https://github.com/msys2/MINGW-packages/pull/10461 https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html Common Vulnerability Exposure (CVE) ID: CVE-2023-29007 https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.