Security News > 2023 > January > Git Users Urged to Update Software to Prevent Remote Code Execution Attacks

The maintainers of the Git source code version control system have released updates to remediate two critical vulnerabilities that could be exploited by a malicious actor to achieve remote code execution.
X41 D-Sec security researchers Markus Vervier and Eric Sesterhenn as well as GitLab's Joern Schneeweisz have been credited with reporting the bugs.
"The most severe issue discovered allows an attacker to trigger a heap-based memory corruption during clone or pull operations, which might result in code execution," the German cybersecurity company said of CVE-2022-23521.
CVE-2022-41903, also a critical vulnerability, is triggered during an archive operation, leading to code execution by way of an integer overflow flaw that arises when formatting the commit logs.
While there are no workarounds for CVE-2022-23521, Git is recommending that users disable "Git archive" in untrusted repositories as a mitigation for CVE-2022-41903 in scenarios where updating to the latest version is not an option.
GitLab, in a coordinated advisory, said it has released versions 15.7.5, 15.6.6, and 15.5.9 for GitLab Community Edition and Enterprise Edition to address the shortcomings, urging customers to apply the fixes with immediate effect.
News URL
https://thehackernews.com/2023/01/git-users-urged-to-update-software-to.html
Related news
- New “whoAMI” Attack Exploits AWS AMI Name Confusion for Remote Code Execution (source)
- Ruijie Networks' Cloud Platform Flaws Could've Exposed 50,000 Devices to Remote Attacks (source)
- Critical RCE Flaw in GFI KerioControl Allows Remote Code Execution via CRLF Injection (source)
- Rsync vulnerabilities allow remote code execution on servers, patch quickly! (source)
- Over 660,000 Rsync servers exposed to code execution attacks (source)
- Meta's Llama Framework Flaw Exposes AI Systems to Remote Code Execution Risks (source)
- Clone2Leak attacks exploit Git flaws to steal credentials (source)
- Critical Cacti Security Flaw (CVE-2025-22604) Enables Remote Code Execution (source)
- New Veeam Flaw Allows Arbitrary Code Execution via Man-in-the-Middle Attack (source)
- whoAMI attacks give hackers code execution on Amazon EC2 instances (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-01-17 | CVE-2022-41903 | Unspecified vulnerability in Git-Scm GIT Git is distributed revision control system. | 9.8 |
2023-01-17 | CVE-2022-23521 | Unspecified vulnerability in Git-Scm GIT Git is distributed revision control system. | 9.8 |