Git Remote Code Execution vulnerabilities as of January 17, 2023

Question

GitHub Blog: https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2

Git has 3 new Remote Code Execution vulnerabilities.

It's said in the blog that Git was already patched by version 2.39.1. But, I don't think they explicitly said that GitHub Desktop has upgraded its embedded Git to 2.39.1.

GitHub Desktop Release Notes: https://desktop.github.com/release-notes

As per January 18th release comes with upgraded git version 2.35.6. The latest January 25th release does not include the new embedded git version 2.39.1. Am I right to assume that GitHub Desktop still has unpatched version of Git?

And lastly, GitHub Blog said that they scanned all repositories in GitHub.com and found no evidence concerning the site being used as an attack vector. But, do we also have sources that GitLab did the same on their side?

Answer 1

The vulnerabilities were not only fixed in 2.39.1 The fixes were also backported to earlier versions. Specifically, v2.35.6 also fixes CVE-2022-41903 and CVE-2022-23521.

See the columns Patched versions on https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89 and https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq

Thus, the GitHub Desktop release 3.1.4 of January 18th 2023, which upgrades the embedded Git to 2.35.6, already fixed these issues.

CVE-2022-41953 would appear not to be included there, but that only covers cloning on Windows using git gui (which may not be included/used by GitHub Desktop?)