Bug 33216 - git new security issues CVE-2024-3200[24], CVE-2024-3202[01] and CVE-2024-32465
Summary: git new security issues CVE-2024-3200[24], CVE-2024-3202[01] and CVE-2024-32465
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-05-15 10:34 CEST by Nicolas Salguero
Modified: 2024-06-03 20:31 CEST (History)
3 users (show)

See Also:
Source RPM: git-2.41.0-1.mga9.src.rpm
CVE: CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021, CVE-2024-32465
Status comment: Fixed upstream in 2.41.1

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2024-05-15 10:34:26 CEST 
Those CVEs were announced here:
https://www.openwall.com/lists/oss-security/2024/05/14/2

The problems are fixed in version 2.41.1.
Nicolas Salguero 2024-05-15 10:35:32 CEST

CVE: (none) => CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021, CVE-2024-32465
Status comment: (none) => Fixed upstream in 2.41.1
Source RPM: (none) => git-2.41.0-1.mga9.src.rpm

Comment 1 Lewis Smith 2024-05-16 20:42:24 CEST 
You routinely look after git, Stig.

Assignee: bugsquad => smelror

Comment 2 Nicolas Salguero 2024-05-29 15:42:42 CEST 
Ubuntu has issued an advisory on May 28:
https://ubuntu.com/security/notices/USN-6793-1
Comment 3 Stig-Ørjan Smelror 2024-05-29 16:52:51 CEST 
Advisory
========

Updated Git to version 2.41.1 to fix

CVE-2024-32002
CVE-2024-32004
CVE-2024-32020
CVE-2024-32021
CVE-2024-32465

References
==========

https://www.openwall.com/lists/oss-security/2024/05/14/2
https://ubuntu.com/security/notices/USN-6793-1
https://nvd.nist.gov/vuln/detail/CVE-2024-32002
https://nvd.nist.gov/vuln/detail/CVE-2024-32004
https://nvd.nist.gov/vuln/detail/CVE-2024-32020
https://nvd.nist.gov/vuln/detail/CVE-2024-32021
https://nvd.nist.gov/vuln/detail/CVE-2024-32465

Files
=====

Uploaded to core/updates_testing

git-2.41.1-1.mga9                                                                                                           
git-prompt-2.41.1-1.mga9                                                                                                    
git-core-oldies-2.41.1-1.mga9                                                                                               
git-arch-2.41.1-1.mga9                                                                                                      
perl-Git-2.41.1-1.mga9                                                                                                      
git-email-2.41.1-1.mga9                                                                                                     
git-svn-2.41.1-1.mga9                                                                                                       
perl-Git-SVN-2.41.1-1.mga9                                                                                                  
git-cvs-2.41.1-1.mga9                                                                                                       
gitweb-2.41.1-1.mga9                                                                                                        
gitk-2.41.1-1.mga9                                                                                                          
git-scalar-2.41.1-1.mga9                                                                                                    
git-subtree-2.41.1-1.mga9                                                                                                   
lib64git-devel-2.41.1-1.mga9                                                                                                
git-core-2.41.1-1.mga9

from git-2.41.1-1.mga9.src.rpm

Assignee: smelror => qa-bugs

katnatek 2024-05-29 20:44:18 CEST

Keywords: (none) => advisory

Comment 4 katnatek 2024-05-30 05:16:46 CEST 
RH mageia 9 x86_64

Updated without issues, use packages to build ansel (https://github.com/aurelienpierreeng/ansel) - a fork of darktable - 

Part of the build log shows

git clone --recurse-submodules --depth 1 https://github.com/aurelienpierreeng/ansel.git
Cloning into 'ansel'...
remote: Enumerating objects: 1265, done.
remote: Counting objects: 100% (1265/1265), done.
remote: Compressing objects: 100% (1128/1128), done.
remote: Total 1265 (delta 207), reused 358 (delta 103), pack-reused 0
Receiving objects: 100% (1265/1265), 54.59 MiB | 6.42 MiB/s, done.
Resolving deltas: 100% (207/207), done.
Submodule 'src/external/LibRaw' (https://github.com/LibRaw/LibRaw.git) registered for path 'src/external/LibRaw'
Submodule 'src/external/OpenCL' (https://github.com/KhronosGroup/OpenCL-Headers.git) registered for path 'src/external/OpenCL'
Submodule 'src/external/libxcf' (https://github.com/houz/libxcf.git) registered for path 'src/external/libxcf'
Submodule 'src/external/rawspeed' (https://github.com/darktable-org/rawspeed.git) registered for path 'src/external/rawspeed'
Submodule 'src/external/whereami' (https://github.com/gpakosz/whereami) registered for path 'src/external/whereami'
Cloning into '/home/katnatek/rpm/BUILD/ansel-0.0.0/ansel/src/external/LibRaw'...
remote: Enumerating objects: 17522, done.        
remote: Counting objects: 100% (1099/1099), done.        
remote: Compressing objects: 100% (506/506), done.        
remote: Total 17522 (delta 713), reused 908 (delta 591), pack-reused 16423        
Receiving objects: 100% (17522/17522), 11.67 MiB | 5.06 MiB/s, done.
Resolving deltas: 100% (13631/13631), done.
Cloning into '/home/katnatek/rpm/BUILD/ansel-0.0.0/ansel/src/external/OpenCL'...
remote: Enumerating objects: 1369, done.        
remote: Counting objects: 100% (399/399), done.        
remote: Compressing objects: 100% (186/186), done.        
remote: Total 1369 (delta 297), reused 264 (delta 205), pack-reused 970        
Receiving objects: 100% (1369/1369), 778.82 KiB | 1.95 MiB/s, done.
Resolving deltas: 100% (881/881), done.
Cloning into '/home/katnatek/rpm/BUILD/ansel-0.0.0/ansel/src/external/libxcf'...
remote: Enumerating objects: 28, done.        
remote: Counting objects: 100% (28/28), done.        
remote: Compressing objects: 100% (18/18), done.        
remote: Total 28 (delta 12), reused 26 (delta 10), pack-reused 0        
Receiving objects: 100% (28/28), 116.74 KiB | 545.00 KiB/s, done.
Resolving deltas: 100% (12/12), done.
Cloning into '/home/katnatek/rpm/BUILD/ansel-0.0.0/ansel/src/external/rawspeed'...
remote: Enumerating objects: 47035, done.        
remote: Counting objects: 100% (7180/7180), done.        
remote: Compressing objects: 100% (1178/1178), done.        
remote: Total 47035 (delta 6284), reused 6703 (delta 6002), pack-reused 39855        
Receiving objects: 100% (47035/47035), 14.11 MiB | 5.96 MiB/s, done.
Resolving deltas: 100% (37444/37444), done.
Cloning into '/home/katnatek/rpm/BUILD/ansel-0.0.0/ansel/src/external/whereami'...
remote: Enumerating objects: 241, done.        
remote: Counting objects: 100% (63/63), done.        
remote: Compressing objects: 100% (15/15), done.        
remote: Total 241 (delta 51), reused 54 (delta 47), pack-reused 178        
Receiving objects: 100% (241/241), 55.13 KiB | 282.00 KiB/s, done.
Resolving deltas: 100% (107/107), done.
remote: Enumerating objects: 24, done.
remote: Counting objects: 100% (24/24), done.
remote: Compressing objects: 100% (14/14), done.
remote: Total 24 (delta 10), reused 10 (delta 10), pack-reused 0
Unpacking objects: 100% (24/24), 3.40 KiB | 580.00 KiB/s, done.
From https://github.com/LibRaw/LibRaw
 * branch              ee087e3fedc8a82a5aeb77f86ecc9daadef5108c -> FETCH_HEAD
Submodule path 'src/external/LibRaw': checked out 'ee087e3fedc8a82a5aeb77f86ecc9daadef5108c'
Submodule path 'src/external/OpenCL': checked out '1aa1139b58a515877a923cce6b254e09d1b2fb2c'
Submodule path 'src/external/libxcf': checked out '64efecf63ddd952ccf654e479714aaae6f8c5986'
Submodule path 'src/external/rawspeed': checked out '6e0d1e8d6fffcb6b0af787b6f7ad6bd99c1bb6b2'
Submodule path 'src/external/whereami': checked out 'ba364cd54fd431c76c045393b6522b4bff547f50'

The build finish without issues, I know this is just a partial test and not follow procedure in bug#31553 or bug#31856 comment#1

Thomas you decide if is valid test or need that I follow previous test

CC: (none) => andrewsfarm

Comment 5 PC LX 2024-06-01 13:25:31 CEST 
Installed and tested without issues.

Tested:
- for two days of work and about two dozen commits;
- with existing and new repositories;
- pull/push from/to gitea, github, and gitlab;
- integration with Kate, Qt Creator, Netbeans, and KDevelop;
- bunch of CLI commands.

All OK.



System Server: Mageia 9, x86_64, Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz.

$ uname -a
Linux marte 6.6.28-desktop-1.mga9 #1 SMP PREEMPT_DYNAMIC Wed Apr 17 17:19:36 UTC 2024 x86_64 GNU/Linux
$ rpm -qa | grep -iP 'git.*-2.41.1'
git-core-2.41.1-1.mga9
perl-Git-2.41.1-1.mga9
git-email-2.41.1-1.mga9
git-2.41.1-1.mga9



System Workstation: Mageia 9, x86_64, AMD Ryzen 5 5600G with Radeon Graphics.

$ uname -a
Linux jupiter 6.6.28-desktop-1.mga9 #1 SMP PREEMPT_DYNAMIC Wed Apr 17 17:19:36 UTC 2024 x86_64 GNU/Linux
$ rpm -qa | grep -iP 'git.*-2.41.1'
git-core-2.41.1-1.mga9
git-prompt-2.41.1-1.mga9
perl-Git-2.41.1-1.mga9
git-email-2.41.1-1.mga9
perl-Git-SVN-2.41.1-1.mga9
git-svn-2.41.1-1.mga9
git-cvs-2.41.1-1.mga9
git-arch-2.41.1-1.mga9
git-core-oldies-2.41.1-1.mga9
gitk-2.41.1-1.mga9
git-2.41.1-1.mga9

CC: (none) => mageia

Comment 6 katnatek 2024-06-02 01:55:29 CEST 
Give OK due comment#5

Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2024-06-02 13:27:48 CEST 
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2024-06-03 20:31:40 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0204.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.