The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5376-1 advisory.

     discovered that Git incorrectly handled certain repository paths in platforms with multiple     users support. An attacker could possibly use this issue to run arbitrary commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1306-1 advisory.

  - Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users     working on multi-user machines, where untrusted parties have write access to the same hard disk. Those     untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run     supposedly outside a repository while searching for a Git directory. Git would then respect any config in     said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who     installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are     vulnerable: simply creating a new project would already read and respect the config specified in     `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The     problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git`     on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
    Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user     profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. (CVE-2022-24765)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1484-1 advisory.

  - Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users     working on multi-user machines, where untrusted parties have write access to the same hard disk. Those     untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run     supposedly outside a repository while searching for a Git directory. Git would then respect any config in     said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who     installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are     vulnerable: simply creating a new project would already read and respect the config specified in     `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The     problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git`     on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
    Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user     profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. (CVE-2022-24765)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.36.1-1.75. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1589 advisory.

    A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in     a local multi-user system when running commands specified in the local repository configuration.  This     allows the owner of the repository to cause arbitrary commands to be executed by other users who access     the repository. (CVE-2022-24765)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-067 advisory.

    A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in     a local multi-user system when running commands specified in the local repository configuration.  This     allows the owner of the repository to cause arbitrary commands to be executed by other users who access     the repository. (CVE-2022-24765)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-470c7ea49e advisory.

    Update to 1.3.2 (CVE-2022-29187, CVE-2022-24765)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159687	Ubuntu 18.04 LTS / 20.04 LTS : Git vulnerability (USN-5376-1)	Nessus	Ubuntu Local Security Checks	2022/4/12	2024/8/28	high
160099	SUSE SLES12 Security Update : git (SUSE-SU-2022:1306-1)	Nessus	SuSE Local Security Checks	2022/4/23	2023/7/13	high
160460	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2022:1484-1)	Nessus	SuSE Local Security Checks	2022/5/3	2023/7/14	high
162009	Amazon Linux AMI : git (ALAS-2022-1589)	Nessus	Amazon Linux Local Security Checks	2022/6/10	2024/12/11	high
164730	Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-067)	Nessus	Amazon Linux Local Security Checks	2022/9/6	2024/12/11	high
170692	Fedora 37 : libgit2 (2023-470c7ea49e)	Nessus	Fedora Local Security Checks	2023/1/27	2024/11/14	high
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	2025/8/19	2025/8/23	critical

检测

插件搜索

high

high

high

high

high

high

critical