The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0407 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree     (CVE-2022-24765)

    * git: Bypass of safe.directory protections (CVE-2022-29187)

    * git: exposure of sensitive information to a malicious actor (CVE-2022-39253)

    * git: git shell function that splits command arguments can lead to arbitrary heap writes.
    (CVE-2022-39260)

    * git: data exfiltration with maliciously crafted repository (CVE-2023-22490)

    * git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-fb088df94c advisory.

    Upstream update including security & bug fixes as well as feature enhancements.

    From the upstream [release     notes](https://github.com/git/git/raw/v2.38.1/Documentation/RelNotes/2.30.6.txt):

    CVE-2022-39253
    --------------

    When relying on the `--local` clone optimization, Git dereferences     symbolic links in the source repository before creating hardlinks     (or copies) of the dereferenced link in the destination repository.
    This can lead to surprising behavior where arbitrary files are     present in a repository's `$GIT_DIR` when cloning from a malicious     repository.

    Git will no longer dereference symbolic links via the `--local`     clone mechanism, and will instead refuse to clone repositories that     have symbolic links present in the `$GIT_DIR/objects` directory.

    Additionally, the value of `protocol.file.allow` is changed to be     user by default.

    CVE-2022-39260
    --------------

    An overly-long command string given to `git shell` can result in     overflow in `split_cmdline()`, leading to arbitrary heap writes and     remote code execution when `git shell` is exposed and the directory     `$HOME/git-shell-commands` exists.

    `git shell` is taught to refuse interactive commands that are     longer than 4MiB in size. `split_cmdline()` is hardened to reject     inputs larger than 2GiB.

    Credits
    -------

    Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The     fix was authored by Taylor Blau, with help from Johannes Schindelin.

    Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub.
    The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5623:05 advisory.

    * git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree     (CVE-2022-24765)
      * git: Bypass of safe.directory protections (CVE-2022-29187)
      * git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
      * git: git shell function that splits command arguments can lead to arbitrary heap writes.
    (CVE-2022-39260)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-53aadd995f advisory.

    Upstream update including security & bug fixes as well as feature enhancements.

    From the upstream [release     notes](https://github.com/git/git/raw/v2.38.1/Documentation/RelNotes/2.30.6.txt):

    CVE-2022-39253
    --------------

    When relying on the `--local` clone optimization, Git dereferences     symbolic links in the source repository before creating hardlinks     (or copies) of the dereferenced link in the destination repository.
    This can lead to surprising behavior where arbitrary files are     present in a repository's `$GIT_DIR` when cloning from a malicious     repository.

    Git will no longer dereference symbolic links via the `--local`     clone mechanism, and will instead refuse to clone repositories that     have symbolic links present in the `$GIT_DIR/objects` directory.

    Additionally, the value of `protocol.file.allow` is changed to be     user by default.

    CVE-2022-39260
    --------------

    An overly-long command string given to `git shell` can result in     overflow in `split_cmdline()`, leading to arbitrary heap writes and     remote code execution when `git shell` is exposed and the directory     `$HOME/git-shell-commands` exists.

    `git shell` is taught to refuse interactive commands that are     longer than 4MiB in size. `split_cmdline()` is hardened to reject     inputs larger than 2GiB.

    Credits
    -------

    Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The     fix was authored by Taylor Blau, with help from Johannes Schindelin.

    Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub.
    The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by     either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-     hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing     at sensitive information on the victim's machine. This can be done either by having the victim clone a     malicious repository on the same machine, or having them clone a malicious repository embedded as a bare     repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
    Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in     the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning     untrusted repositories using the `--local` optimization when on a shared machine, either by passing the     `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,     avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global     protocol.file.allow user`. (CVE-2022-39253)

  - Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an `int` to represent the number of entries in the array, allowing a     malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the     resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code     execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell     in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4,     2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
    Disabling `git shell` access via remote logins is a viable short-term workaround. (CVE-2022-39260)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2859 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree     (CVE-2022-24765)

    * git: Bypass of safe.directory protections (CVE-2022-29187)

    * git: exposure of sensitive information to a malicious actor (CVE-2022-39253)

    * git: git shell function that splits command arguments can lead to arbitrary heap writes.
    (CVE-2022-39260)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986161 advisory.

    Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login     shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6,     2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments     into an array improperly uses an `int` to represent the number of entries in the array, allowing a     malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the     resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code     execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell     in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4,     2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
    Disabling `git shell` access via remote logins is a viable short-term workaround.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5936:07 advisory.

    * git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree     (CVE-2022-24765)
      * git: Bypass of safe.directory protections (CVE-2022-29187)
      * git: exposure of sensitive information to a malicious actor (CVE-2022-39253)
      * git: git shell function that splits command arguments can lead to arbitrary heap writes.
    (CVE-2022-39260)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
189543	RHEL 8 : git (RHSA-2024:0407)	Nessus	Red Hat Local Security Checks	2024/1/25	2024/11/7	high
203242	Photon OS 4.0: Git PHSA-2022-4.0-0271	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
211059	Fedora 37 : git (2022-fb088df94c)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
291846	MiracleLinux 9 : git-2.39.1-1.el9 (AXSA:2023-5623:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
169117	Fedora 35 : git (2022-53aadd995f)	Nessus	Fedora Local Security Checks	2022/12/22	2024/11/14	high
169608	EulerOS 2.0 SP9 : git (EulerOS-SA-2023-1099)	Nessus	Huawei Local Security Checks	2023/1/6	2023/1/6	high
175878	RHEL 8 : git (RHSA-2023:2859)	Nessus	Red Hat Local Security Checks	2023/5/16	2024/11/7	high
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	2025/8/19	2025/8/23	critical
268691	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2025-986161)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	high
293144	MiracleLinux 8 : git-2.39.1-1.el8 (AXSA:2023-5936:07)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

critical

high

high