update: dev-vcs/git

[tormath1]

Name: dev-vcs/git
CVEs: CVE-2024-50349, CVE-2024-52005, CVE-2024-52006
CVSSs: 2.1, 7.5, 2.1
Action Needed: upgrade to >= v2.45.3

Summary:

• CVE-2024-50349: Printing unsanitized URLs when asking for credentials makes the user susceptible to crafted URLs (e.g. in recursive clones). These URLs can mislead the user into typing in passwords for trusted sites that would then be sent to untrusted sites instead. A potential scenario of how this can be exploited is a recursive clone where one of the submodules prompts for a password, pretending to ask for a different host than the password will be sent to.
• CVE-2024-52005: When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.
  • https://bugzilla.redhat.com/show_bug.cgi?id=2338289
• CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to credential helpers which use line-reading functions that interpret Carriage Returns as line endings, even though this is not what was intended (but Git’s documentation did not clarify that "newline" meant "Line Feed character"). This affected the popular .NET-based Git Credential Manager, which has been updated accordingly in coordination with the Git project.

refmap.gentoo: CVE-2024-{50349, 52006}: https://bugs.gentoo.org/948111, CVE-2024-52005: TBD

[dongsupark]

Added CVE-2024-52005.