Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:2579-1 Final 1 1 2024-07-22T10:36:35Z current 2024-07-22T10:36:35Z 2024-07-22T10:36:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git fixes the following issues: - CVE-2024-24577: Fixed arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/bci-sle15-kernel-module-devel:15.7-2024-2579,Container bci/bci-sle15-kernel-module-devel:latest-2024-2579,Container bci/gcc:latest-2024-2579,Container bci/golang:1.22-openssl-2024-2579,Container bci/golang:1.23-2024-2579,Container bci/golang:latest-2024-2579,Container bci/kiwi:latest-2024-2579,Container bci/node:22-2024-2579,Container bci/nodejs:latest-2024-2579,Container bci/openjdk:17-2024-2579,Container bci/openjdk:latest-2024-2579,Container bci/python:3-2024-2579,Container bci/python:3.13-2024-2579,Container bci/python:latest-2024-2579,Container bci/ruby:3-2024-2579,Container bci/ruby:latest-2024-2579,Container bci/spack:0.23-2024-2579,Container bci/spack:latest-2024-2579,Container containers/python:3.11-2024-2579,Container containers/python:3.9-2024-2579,Container containers/pytorch:2-nvidia-2024-2579,Container containers/pytorch:2.5.0-2024-2579,Container suse/git:latest-2024-2579,Image ai_15_6-2024-2579,Image python_15_6-2024-2579,SUSE-2024-2579,SUSE-SLE-Module-Basesystem-15-SP6-2024-2579,SUSE-SLE-Module-Development-Tools-15-SP6-2024-2579,openSUSE-SLE-15.6-2024-2579 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20242579-1/ Link for SUSE-SU-2024:2579-1 https://lists.suse.com/pipermail/sle-security-updates/2024-July/019012.html E-Mail link for SUSE-SU-2024:2579-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1219660 SUSE Bug 1219660 https://www.suse.com/security/cve/CVE-2024-24577/ SUSE CVE CVE-2024-24577 page Container bci/bci-sle15-kernel-module-devel:15.7 Container bci/bci-sle15-kernel-module-devel:latest Container bci/gcc:latest Container bci/golang:1.22-openssl Container bci/golang:1.23 Container bci/golang:latest Container bci/kiwi:latest Container bci/node:22 Container bci/nodejs:latest Container bci/openjdk:17 Container bci/openjdk:latest Container bci/python:3 Container bci/python:3.13 Container bci/python:latest Container bci/ruby:3 Container bci/ruby:latest Container bci/spack:0.23 Container bci/spack:latest Container containers/python:3.11 Container containers/python:3.9 Container containers/pytorch:2-nvidia Container containers/pytorch:2.5.0 Container suse/git:latest Image ai_15_6 Image python_15_6 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 openSUSE Leap 15.6 git-core-2.43.0-150600.3.6.1 git-2.43.0-150600.3.6.1 perl-Git-2.43.0-150600.3.6.1 git-arch-2.43.0-150600.3.6.1 git-credential-libsecret-2.43.0-150600.3.6.1 git-cvs-2.43.0-150600.3.6.1 git-daemon-2.43.0-150600.3.6.1 git-doc-2.43.0-150600.3.6.1 git-email-2.43.0-150600.3.6.1 git-gui-2.43.0-150600.3.6.1 git-p4-2.43.0-150600.3.6.1 git-svn-2.43.0-150600.3.6.1 git-web-2.43.0-150600.3.6.1 gitk-2.43.0-150600.3.6.1 git-core-2.43.0-150600.3.6.1 as a component of Container bci/bci-sle15-kernel-module-devel:15.7 git-core-2.43.0-150600.3.6.1 as a component of Container bci/bci-sle15-kernel-module-devel:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/gcc:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/golang:1.22-openssl git-core-2.43.0-150600.3.6.1 as a component of Container bci/golang:1.23 git-core-2.43.0-150600.3.6.1 as a component of Container bci/golang:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/kiwi:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/node:22 git-core-2.43.0-150600.3.6.1 as a component of Container bci/nodejs:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/openjdk:17 git-core-2.43.0-150600.3.6.1 as a component of Container bci/openjdk:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/python:3 git-core-2.43.0-150600.3.6.1 as a component of Container bci/python:3.13 git-core-2.43.0-150600.3.6.1 as a component of Container bci/python:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/ruby:3 git-core-2.43.0-150600.3.6.1 as a component of Container bci/ruby:latest git-2.43.0-150600.3.6.1 as a component of Container bci/spack:0.23 git-core-2.43.0-150600.3.6.1 as a component of Container bci/spack:0.23 perl-Git-2.43.0-150600.3.6.1 as a component of Container bci/spack:0.23 git-2.43.0-150600.3.6.1 as a component of Container bci/spack:latest git-core-2.43.0-150600.3.6.1 as a component of Container bci/spack:latest perl-Git-2.43.0-150600.3.6.1 as a component of Container bci/spack:latest git-core-2.43.0-150600.3.6.1 as a component of Container containers/python:3.11 git-core-2.43.0-150600.3.6.1 as a component of Container containers/python:3.9 git-core-2.43.0-150600.3.6.1 as a component of Container containers/pytorch:2-nvidia git-core-2.43.0-150600.3.6.1 as a component of Container containers/pytorch:2.5.0 git-core-2.43.0-150600.3.6.1 as a component of Container suse/git:latest git-core-2.43.0-150600.3.6.1 as a component of Image ai_15_6 git-core-2.43.0-150600.3.6.1 as a component of Image python_15_6 git-core-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 git-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-arch-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-cvs-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-daemon-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-doc-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-email-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-gui-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-svn-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-web-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 gitk-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 perl-Git-2.43.0-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 git-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-arch-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-core-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-credential-libsecret-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-cvs-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-daemon-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-doc-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-email-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-gui-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-p4-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-svn-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 git-web-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 gitk-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 perl-Git-2.43.0-150600.3.6.1 as a component of openSUSE Leap 15.6 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. CVE-2024-24577 Container bci/bci-sle15-kernel-module-devel:15.7:git-core-2.43.0-150600.3.6.1 Container bci/bci-sle15-kernel-module-devel:latest:git-core-2.43.0-150600.3.6.1 Container bci/gcc:latest:git-core-2.43.0-150600.3.6.1 Container bci/golang:1.22-openssl:git-core-2.43.0-150600.3.6.1 Container bci/golang:1.23:git-core-2.43.0-150600.3.6.1 Container bci/golang:latest:git-core-2.43.0-150600.3.6.1 Container bci/kiwi:latest:git-core-2.43.0-150600.3.6.1 Container bci/node:22:git-core-2.43.0-150600.3.6.1 Container bci/nodejs:latest:git-core-2.43.0-150600.3.6.1 Container bci/openjdk:17:git-core-2.43.0-150600.3.6.1 Container bci/openjdk:latest:git-core-2.43.0-150600.3.6.1 Container bci/python:3.13:git-core-2.43.0-150600.3.6.1 Container bci/python:3:git-core-2.43.0-150600.3.6.1 Container bci/python:latest:git-core-2.43.0-150600.3.6.1 Container bci/ruby:3:git-core-2.43.0-150600.3.6.1 Container bci/ruby:latest:git-core-2.43.0-150600.3.6.1 Container bci/spack:0.23:git-2.43.0-150600.3.6.1 Container bci/spack:0.23:git-core-2.43.0-150600.3.6.1 Container bci/spack:0.23:perl-Git-2.43.0-150600.3.6.1 Container bci/spack:latest:git-2.43.0-150600.3.6.1 Container bci/spack:latest:git-core-2.43.0-150600.3.6.1 Container bci/spack:latest:perl-Git-2.43.0-150600.3.6.1 Container containers/python:3.11:git-core-2.43.0-150600.3.6.1 Container containers/python:3.9:git-core-2.43.0-150600.3.6.1 Container containers/pytorch:2-nvidia:git-core-2.43.0-150600.3.6.1 Container containers/pytorch:2.5.0:git-core-2.43.0-150600.3.6.1 Container suse/git:latest:git-core-2.43.0-150600.3.6.1 Image ai_15_6:git-core-2.43.0-150600.3.6.1 Image python_15_6:git-core-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:git-core-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-arch-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-cvs-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-daemon-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-doc-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-email-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-gui-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-svn-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:git-web-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:gitk-2.43.0-150600.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:perl-Git-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-arch-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-core-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-credential-libsecret-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-cvs-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-daemon-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-doc-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-email-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-gui-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-p4-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-svn-2.43.0-150600.3.6.1 openSUSE Leap 15.6:git-web-2.43.0-150600.3.6.1 openSUSE Leap 15.6:gitk-2.43.0-150600.3.6.1 openSUSE Leap 15.6:perl-Git-2.43.0-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20242579-1/ https://www.suse.com/security/cve/CVE-2024-24577.html CVE-2024-24577 https://bugzilla.suse.com/1219660 SUSE Bug 1219660