GitLab has printed patches to 2 vital vulnerabilities within the standard Git model management software program.
Because the group said in its advisorythe fixes for CVE-2022-41903 and CVE-2022-23521 have already been carried out on its GitLab.com and GitLab Devoted companies.
Each the bugs are integer overflows that result in potential distant code execution.
CVE-2022-41903 is a bug in its git log and git archive features.
The advisory acknowledged: “When processing the padding operators, there’s an integer overflow in `fairly.c::format_and_pad_commit()` the place a `size_t` is saved improperly as an `int`, after which added as an offset to a ` memcpy()`.”
The overflow could be triggered instantly “by a person working a command which invokes the commit formatting equipment”, or not directly “by git archive through the export-subst mechanism”. Both strategy ends in arbitrary writes to heap reminiscence.
If a person is unable to improve, the advisory mentioned they need to “disable ‘git archive’ in untrusted repositories”.
CVE-2022-23521 is a parsing integer overflow within the gitattributes perform.
“When parsing gitattributes, a number of integer overflows can happen when there’s a big variety of path patterns, an enormous variety of attributes for a single sample, or when the declared attribute names are big”, the advisory acknowledged.
There isn’t any workaround for the vulnerability.
GitLab has pushed the 2 fixes in variations 15.7.5, 15.6.6, and 15.5.9 of GitLab Group Version (CE) and Enterprise Version (EE).
