Test ID:	1.3.6.1.4.1.25623.1.1.4.2021.2555.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2021:2555-1)
Summary:	The remote host is missing an update for the 'git' package(s) announced via the SUSE-SU-2021:2555-1 advisory.
Description:	Summary: The remote host is missing an update for the 'git' package(s) announced via the SUSE-SU-2021:2555-1 advisory. Vulnerability Insight: This update for git fixes the following issues: Update from version 2.26.2 to version 2.31.1 (jsc#SLE-18152) Security fixes: CVE-2021-21300: On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could run remote code during a clone. (bsc#1183026) Non security changes: Add `sysusers` file to create `git-daemon` user. Remove `perl-base` and `openssh-server` dependency on `git-core`and provide a `perl-Git` package. (jsc#SLE-17838) `fsmonitor` bug fixes Fix `git bisect` to take an annotated tag as a good/bad endpoint Fix a corner case in `git mv` on case insensitive systems Require only `openssh-clients` where possible (like Tumbleweed or SUSE Linux Enterprise >= 15 SP3). (bsc#1183580) Drop `rsync` requirement, not necessary anymore. Use of `pack-redundant` command is discouraged and will trigger a warning. The replacement is `repack -d`. The `--format=%(trailers)` mechanism gets enhanced to make it easier to design output for machine consumption. No longer give message to choose between rebase or merge upon pull if the history `fast-forwards`. The configuration variable `core.abbrev` can be set to `no` to force no abbreviation regardless of the hash algorithm `git rev-parse` can be explicitly told to give output as absolute or relative path with the `--path-format=(absoluterelative)` option. Bash completion update to make it easier for end-users to add completion for their custom `git` subcommands. `git maintenance` learned to drive scheduled maintenance on platforms whose native scheduling methods are not 'cron'. After expiring a reflog and making a single commit, the reflog for the branch would record a single entry that knows both `@{0}` and `@{1}`, but we failed to answer 'what commit were we on?', i.e. `@{1}` `git bundle` learns `--stdin` option to read its refs from the standard input. Also, it now does not lose refs when they point at the same object. `git log` learned a new `--diff-merges=` option. `git ls-files` can and does show multiple entries when the index is unmerged, which is a source for confusion unless `-s/-u` option is in use. A new option `--deduplicate` has been introduced. `git worktree list` now annotates worktrees as prunable, shows locked and prunable attributes in `--porcelain mode`, and gained a `--verbose` option. `git clone` tries to locally check out the branch pointed at by HEAD of the remote repository after it is done, but the protocol did not convey the information necessary to do so when copying an empty repository. The protocol v2 learned how to do so. There are other ways than `..` for a single token to denote a `commit range', namely `^!` and `^-`, but `git range-diff` did not understand them. The `git range-diff` command learned `--(leftright)-only` option to show ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'git' package(s) on SUSE Linux Enterprise Module for Basesystem 15-SP3, SUSE Linux Enterprise Module for Development Tools 15-SP3. Solution: Please install the updated package(s). CVSS Score: 5.1 CVSS Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-21300 https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/ http://seclists.org/fulldisclosure/2021/Apr/60 https://security.gentoo.org/glsa/202104-01 http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks https://git-scm.com/docs/gitattributes#_filter https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592 https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/ https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html http://www.openwall.com/lists/oss-security/2021/03/09/3
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.