USN-8012-1

It was discovered that GitHub CLI could behave unexpectedly if users downloaded a malicious GitHub Actions workflow artifact through gh run download. An attacker could possibly use this issue to create or overwrite files in unintended directories. (CVE-2024-54132)

It was discovered that GitHub CLI could behave unexpectedly when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. An attacker could possibly use this issue to gather authentication tokens. (CVE-2024-53858)

References

Affected packages

Ubuntu:Pro:24.04:LTS / gh

Package

Name: gh
Purl: pkg:deb/ubuntu/gh@2.45.0-1ubuntu0.3+esm2?arch=source&distro=esm-apps/noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.45.0-1ubuntu0.3+esm2

Affected versions

2.*

2.27.0+dfsg1-1build1

2.30.0-2

2.35.0-1

2.40.1+dfsg1-1

2.42.1-1

2.43.1-1

2.44.1-1

2.44.1-2

2.45.0-1

2.45.0-1build1

2.45.0-1ubuntu0.1

2.45.0-1ubuntu0.2

2.45.0-1ubuntu0.2+esm1

2.45.0-1ubuntu0.2+esm2

2.45.0-1ubuntu0.3

2.45.0-1ubuntu0.3+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "2.45.0-1ubuntu0.3+esm2",
            "binary_name": "gh"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8012-1.json"

cves_map

{
    "ecosystem": "Ubuntu:Pro:24.04:LTS",
    "cves": [
        {
            "id": "CVE-2024-53858",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-54132",
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}