Directory Traversal Affecting git-svn package, versions <0:2.39.3-1.el8_8


Severity

Recommended
0.0
high
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.11% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Directory Traversal vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ORACLE8-GITSVN-5600070
  • published24 May 2023
  • disclosed14 Feb 2023

Introduced: 14 Feb 2023

CVE-2023-23946  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Oracle:8 git-svn to version 0:2.39.3-1.el8_8 or higher.
This issue was patched in ELSA-2023-3246.

NVD Description

Note: Versions mentioned in the description apply only to the upstream git-svn package and not the git-svn package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the working tree can be overwritten as the user who is running git apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

CVSS Scores

version 3.1