Detections
Analytics

Alpine: multiple docker packages: security update to 20.10.20-r0

medium Tenable Self-Hosted Container Security Plugin ID 404107

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,
 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a
 malicious actor. When performing a local clone (where the source and target of the clone are on the same
 volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by
 either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-
 hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing
 at sensitive information on the victim's machine. This can be done either by having the victim clone a
 malicious repository on the same machine, or having them clone a malicious repository embedded as a bare
 repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
 Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in
 the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning
 untrusted repositories using the `--local` optimization when on a shared machine, either by passing the
 `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,
 avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global
 protocol.file.allow user`. (CVE-2022-39253)

See Also

https://security.alpinelinux.org/vuln/CVE-2022-39253

Plugin Details

Severity: Medium

ID: 404107

Version: Revision 1.27

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.09

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2022-39253

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/18/2022

Reference Information

CVE: CVE-2022-39253