Multiple vulnerabilities have been discovered in Git, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.49.1 | >= 2.49.1 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.49.1"
Several vulnerabilities have been found in Git, the worst of which could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.39.3 | >= 2.39.3 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.39.3"
A vulnerability has been found in Git that could allow a remote attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.26.3 | >= 2.26.3 |
Git is a distributed version control system designed.
It was discovered that Git could be fooled into running remote code during a clone on case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS).
A remote attacker could entice a user to clone a specially crafted repository, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.26.3"
Multiple vulnerabilities have been found in Git which might all allow attackers to access sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.26.2 | >= 2.23.3 (revision), >= 2.24.3 (revision), >= 2.25.4 (revision), >= 2.26.2 (revision) |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details.
A remote attacker, by providing a specially crafted URL, could possibly trick Git into returning credential information for a wrong host.
Disabling credential helpers will prevent this vulnerability.
All Git 2.23.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.23.3"
All Git 2.24.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.24.3"
All Git 2.25.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.25.4"
All Git 2.26.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.26.2"
Multiple vulnerabilities have been found in Git, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.24.1 | >= 2.21.1 (revision), >= 2.23.1-r1 (revision), >= 2.24.1 (revision) |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details.
An attacker could possibly overwrite arbitrary paths, execute arbitrary code, and overwrite files in the .git directory.
There is no known workaround at this time.
All Git 2.21.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.21.1"
All Git 2.23.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.23.1-r1"
All Git 2.24.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.24.1"
Multiple vulnerabilities have been found in Git, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.20.1 | >= 2.20.1 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Multiple vulnerabilities have been discovered in Git. Please review the referenced CVE identifiers for details
Please review the referenced CVE identifier and bugs for details.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.19.2"
Git contains multiple vulnerabilities that allow for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.16.4 | >= 2.16.4 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below for details.
Remote attackers could execute arbitrary code on both client and server.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.16.4"
A command injection vulnerability in Git may allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.13.5 | >= 2.13.5 |
Git is a small and fast distributed version control system designed to handle small and large projects.
Specially crafted ‘ssh://...’ URLs may allow the owner of the repository to execute arbitrary commands on client’s machine if those commands are already installed on the client’s system. This is especially dangerous when the third-party repository has one or more submodules with specially crafted ‘ssh://...’ URLs. Each time the repository is recursively cloned or submodules are updated the payload will be triggered.
A remote attacker, by enticing a user to clone a specially crafted repository, could possibly execute arbitrary code with the privileges of the process.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.13.5"
A vulnerability in Git might allow remote attackers to bypass security restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.13.0 | >= 2.13.0 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Timo Schmid discovered that the Git restricted shell incorrectly filtered allowed commands.
A remote attacker could possibly bypass security restrictions and access sensitive information.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.13.0"
Git contains multiple vulnerabilities that allow for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.7.3-r1 | >= 2.7.3-r1 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Git is vulnerable to the remote execution of arbitrary code by cloning repositories with large filenames or a large number of nested trees. Additionally, some protocols within Git, such as git-remote-ext, can execute arbitrary code found within URLs. These URLs that submodules use may come from arbitrary sources (e.g., .gitmodules files in a remote repository), and can effect those who enable recursive fetch. Restrict the allowed protocols to well known and safe ones.
Remote attackers could execute arbitrary code on both client and server.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.7.3-r1"
An attacker could execute arbitrary commands via Git repositories in a case-insensitive or case-normalizing filesystem.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 2.0.5 | >= 1.8.5.6 (revision), >= 1.9.5 (revision), >= 2.0.5 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
A vulnerability in Git causing Git-compatible clients that access case-insensitive or case-normalizing filesystems to overwrite the .git/config when cloning or checking out a repository, leading to execution of arbitrary commands.
An attacker can execute arbitrary commands on a client machine that clones a crafted malicious Git tree.
There is no known workaround at this time.
All Git 1.8.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-1.8.5.6"
All Git 1.9.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-1.9.5"
All Git 2.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-2.0.5"
A stack-based buffer overflow in Git might allow a local attacker to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-vcs/git | * | < 1.7.2.2 | >= 1.7.2.2 |
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Git contains a stack-based buffer overflow in the is_git_directory function in setup.c.
A local attacker could gain escalated privileges via a specially crafted git repository.
There is no known workaround at this time.
All Git users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/git-1.7.2.2"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 11, 2010. It is likely that your system is already no longer affected by this issue.