Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3484-1 Final 1 1 2021-10-20T14:17:52Z current 2021-10-20T14:17:52Z 2021-10-20T14:17:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git fixes the following issues: - CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path (bsc#1189992). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2021-3484,SUSE-2021-3484,SUSE-OpenStack-Cloud-8-2021-3484,SUSE-SLE-SDK-12-SP5-2021-3484,SUSE-SLE-SERVER-12-SP5-2021-3484 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213484-1/ Link for SUSE-SU-2021:3484-1 https://lists.suse.com/pipermail/sle-security-updates/2021-October/009627.html E-Mail link for SUSE-SU-2021:3484-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1189992 SUSE Bug 1189992 https://www.suse.com/security/cve/CVE-2021-40330/ SUSE CVE CVE-2021-40330 page HPE Helion OpenStack 8 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 8 git-2.26.2-27.49.3 git-arch-2.26.2-27.49.3 git-core-2.26.2-27.49.3 git-credential-gnome-keyring-2.26.2-27.49.3 git-credential-libsecret-2.26.2-27.49.3 git-cvs-2.26.2-27.49.3 git-daemon-2.26.2-27.49.3 git-doc-2.26.2-27.49.3 git-email-2.26.2-27.49.3 git-gui-2.26.2-27.49.3 git-p4-2.26.2-27.49.3 git-svn-2.26.2-27.49.3 git-web-2.26.2-27.49.3 gitk-2.26.2-27.49.3 git-2.26.2-27.49.3 as a component of HPE Helion OpenStack 8 git-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-core-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-cvs-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-daemon-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-email-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-gui-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-svn-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-web-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 gitk-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server 12 SP5 git-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-core-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-cvs-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-daemon-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-email-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-gui-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-svn-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-web-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 gitk-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 git-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-arch-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-core-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-cvs-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-daemon-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-doc-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-email-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-gui-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-svn-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-web-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 gitk-2.26.2-27.49.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 git-2.26.2-27.49.3 as a component of SUSE OpenStack Cloud 8 git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. CVE-2021-40330 HPE Helion OpenStack 8:git-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-core-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-cvs-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-daemon-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-email-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-gui-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-svn-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:git-web-2.26.2-27.49.3 SUSE Linux Enterprise Server 12 SP5:gitk-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-core-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-cvs-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-daemon-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-email-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-gui-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-svn-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:git-web-2.26.2-27.49.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:gitk-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-arch-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-core-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-cvs-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-daemon-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-doc-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-email-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-gui-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-svn-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:git-web-2.26.2-27.49.3 SUSE Linux Enterprise Software Development Kit 12 SP5:gitk-2.26.2-27.49.3 SUSE OpenStack Cloud 8:git-2.26.2-27.49.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213484-1/ https://www.suse.com/security/cve/CVE-2021-40330.html CVE-2021-40330 https://bugzilla.suse.com/1189992 SUSE Bug 1189992