OESA-2022-1765

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1765
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-1765.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2022-1765
Upstream
Published
2022-07-22T11:04:00Z
Modified
2025-08-12T05:13:33.731807Z
Summary
git security update
Details

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce,and ClearCase with features like cheap local branching, convenient staging areas, and multiple workflows.

Security Fix(es):

Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.(CVE-2022-29187)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / git

Package

Name
git
Purl
pkg:rpm/openEuler/git&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.27.0-8.oe1

Ecosystem specific 

{
    "x86_64": [
        "git-debugsource-2.27.0-8.oe1.x86_64.rpm",
        "git-daemon-2.27.0-8.oe1.x86_64.rpm",
        "git-2.27.0-8.oe1.x86_64.rpm",
        "git-debuginfo-2.27.0-8.oe1.x86_64.rpm"
    ],
    "src": [
        "git-2.27.0-8.oe1.src.rpm"
    ],
    "noarch": [
        "git-gui-2.27.0-8.oe1.noarch.rpm",
        "gitk-2.27.0-8.oe1.noarch.rpm",
        "perl-Git-SVN-2.27.0-8.oe1.noarch.rpm",
        "git-svn-2.27.0-8.oe1.noarch.rpm",
        "git-web-2.27.0-8.oe1.noarch.rpm",
        "git-email-2.27.0-8.oe1.noarch.rpm",
        "git-help-2.27.0-8.oe1.noarch.rpm",
        "perl-Git-2.27.0-8.oe1.noarch.rpm"
    ],
    "aarch64": [
        "git-debuginfo-2.27.0-8.oe1.aarch64.rpm",
        "git-2.27.0-8.oe1.aarch64.rpm",
        "git-debugsource-2.27.0-8.oe1.aarch64.rpm",
        "git-daemon-2.27.0-8.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / git

Package

Name
git
Purl
pkg:rpm/openEuler/git&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.27.0-8.oe1

Ecosystem specific 

{
    "x86_64": [
        "git-debuginfo-2.27.0-8.oe1.x86_64.rpm",
        "git-debugsource-2.27.0-8.oe1.x86_64.rpm",
        "git-2.27.0-8.oe1.x86_64.rpm",
        "git-daemon-2.27.0-8.oe1.x86_64.rpm"
    ],
    "src": [
        "git-2.27.0-8.oe1.src.rpm"
    ],
    "noarch": [
        "perl-Git-SVN-2.27.0-8.oe1.noarch.rpm",
        "perl-Git-2.27.0-8.oe1.noarch.rpm",
        "git-help-2.27.0-8.oe1.noarch.rpm",
        "git-gui-2.27.0-8.oe1.noarch.rpm",
        "gitk-2.27.0-8.oe1.noarch.rpm",
        "git-svn-2.27.0-8.oe1.noarch.rpm",
        "git-email-2.27.0-8.oe1.noarch.rpm",
        "git-web-2.27.0-8.oe1.noarch.rpm"
    ],
    "aarch64": [
        "git-daemon-2.27.0-8.oe1.aarch64.rpm",
        "git-2.27.0-8.oe1.aarch64.rpm",
        "git-debugsource-2.27.0-8.oe1.aarch64.rpm",
        "git-debuginfo-2.27.0-8.oe1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS / git

Package

Name
git
Purl
pkg:rpm/openEuler/git&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.33.0-3.oe2203

Ecosystem specific 

{
    "x86_64": [
        "git-debugsource-2.33.0-3.oe2203.x86_64.rpm",
        "git-2.33.0-3.oe2203.x86_64.rpm",
        "git-debuginfo-2.33.0-3.oe2203.x86_64.rpm",
        "git-daemon-2.33.0-3.oe2203.x86_64.rpm"
    ],
    "src": [
        "git-2.33.0-3.oe2203.src.rpm"
    ],
    "noarch": [
        "gitk-2.33.0-3.oe2203.noarch.rpm",
        "git-email-2.33.0-3.oe2203.noarch.rpm",
        "git-svn-2.33.0-3.oe2203.noarch.rpm",
        "git-gui-2.33.0-3.oe2203.noarch.rpm",
        "perl-Git-SVN-2.33.0-3.oe2203.noarch.rpm",
        "git-web-2.33.0-3.oe2203.noarch.rpm",
        "perl-Git-2.33.0-3.oe2203.noarch.rpm",
        "git-help-2.33.0-3.oe2203.noarch.rpm"
    ],
    "aarch64": [
        "git-debugsource-2.33.0-3.oe2203.aarch64.rpm",
        "git-daemon-2.33.0-3.oe2203.aarch64.rpm",
        "git-2.33.0-3.oe2203.aarch64.rpm",
        "git-debuginfo-2.33.0-3.oe2203.aarch64.rpm"
    ]
}