{"id":21030,"date":"2023-01-19T09:10:25","date_gmt":"2023-01-19T17:10:25","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/01\/19\/news-14763\/"},"modified":"2023-01-19T09:10:25","modified_gmt":"2023-01-19T17:10:25","slug":"news-14763","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/01\/19\/news-14763\/","title":{"rendered":"Update now! Two critical flaws in Git’s code found, patched"},"content":{"rendered":"

In a sponsored security source code audit, security experts from X41 D-SEC GmbH (Eric Sesterhenn and Markus Vervier) and GitLab (Joern Schneeweisz) found two notable critical flaws in Git’s code. A vulnerability on Git could generally compromise source code repositories and developer systems, but “wormable” ones could result in large-scale breaches, according to the high-level audit report<\/a>. Microsoft defines<\/a> a flaw as “wormable” if it doesn’t rely on human interaction, instead it allows malware to spread from one vulnerable system to another.<\/p>\n

The two critical flaws, tracked as CVE-2022-23521<\/a><\/strong> and CVE-2022-41903<\/a><\/strong>, could allow threat actors to potentially run malware after taking advantage of overflow weaknesses in a system’s memory.<\/p>\n

A total of eight vulnerabilities were found in Git’s code. On top of the critical ones we mentioned, the experts also found one rated medium, one high, and four rated low severity. 27 other issues found don’t have a direct security impact.<\/p>\n

A copy of the full audit report from X41 and GitLab can be found here<\/a>.<\/p>\n

Recommendation and workaround<\/h2>\n

The easiest way to protect against exploits of these critical vulnerabilities is to upgrade to the latest Git release, which is version 2.39.1<\/a><\/strong>, as well as update your GitLab instance<\/a> to one of these versions: 15.7.5<\/strong>, 15.6.6<\/strong>, and 15.5.9<\/strong>. <\/p>\n