{"id":106827,"date":"2023-02-15T18:48:14","date_gmt":"2023-02-15T16:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=106827"},"modified":"2023-02-16T11:50:36","modified_gmt":"2023-02-16T09:50:36","slug":"uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","title":{"rendered":"Zranitelnosti v Gitu vedouc\u00ed k \u00faniku a p\u0159episov\u00e1n\u00ed dat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Byly zve\u0159ejn\u011bny opravy distribuovan\u00e9ho syst\u00e9mu spr\u00e1vy verze Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 a 2.30.8, kter\u00e9 odstra\u0148uj\u00ed dv\u011b zranitelnosti t\u00fdkaj\u00edc\u00ed se optimalizac\u00ed p\u0159i lok\u00e1ln\u00edm klonov\u00e1n\u00ed a p\u0159\u00edkazu &#171;git apply&#187;. Sledovat vyd\u00e1n\u00ed aktualizac\u00ed bal\u00ed\u010dk\u016f v distribuc\u00edch lze na str\u00e1nk\u00e1ch Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. Pokud nelze aktualizaci nainstalovat, doporu\u010duje se jako obch\u00e1zen\u00ed zabr\u00e1nit prov\u00e1d\u011bn\u00ed operace &#171;git clone&#187; s volbou &#171;&#8212;recurse-submodules&#187; s ned\u016fv\u011bryhodn\u00fdmi repozit\u00e1\u0159i, a tak\u00e9 se vyhnout p\u0159\u00edkaz\u016fm &#171;git apply&#187; a &#171;git am&#187; s neov\u011b\u0159en\u00fdm k\u00f3dem.          <\/p>\n<ul>\n<li class=\"l\"> Zranitelnost CVE-2023-22490 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi, kter\u00fd ovl\u00e1d\u00e1 obsah klonovan\u00e9ho repozit\u00e1\u0159e, z\u00edskat p\u0159\u00edstup k d\u016fv\u011brn\u00fdm dat\u016fm v syst\u00e9mu u\u017eivatele. Vzniku zranitelnosti napom\u00e1haj\u00ed dv\u011b nedostatky:\n<p>Prvn\u00ed nedostatek umo\u017e\u0148uje p\u0159i pr\u00e1ci se speci\u00e1ln\u011b upraven\u00fdm repozit\u00e1\u0159em dos\u00e1hnout pou\u017eit\u00ed m\u00edstn\u00edch optimalizac\u00ed klonov\u00e1n\u00ed i p\u0159i pou\u017eit\u00ed transportu, kter\u00fd interaguje s extern\u00edmi syst\u00e9my.      <\/p>\n<p>Druh\u00fd nedostatek umo\u017e\u0148uje um\u00edst\u011bn\u00ed symbolick\u00e9ho odkazu m\u00edsto adres\u00e1\u0159e $GIT_DIR\/objects, obdobn\u011b jako u zranitelnosti CVE-2022-39253, kde bylo opraveno blokov\u00e1n\u00ed um\u00edst\u011bn\u00ed symbolick\u00fdch odkaz\u016f v adres\u00e1\u0159i $GIT_DIR\/objects, ale nebylo ov\u011b\u0159eno, \u017ee samotn\u00fd adres\u00e1\u0159 $GIT_DIR\/objects m\u016f\u017ee b\u00fdt symbolick\u00fdm odkazem.     <\/p>\n<p>V re\u017eimu lok\u00e1ln\u00edho klonov\u00e1n\u00ed git p\u0159en\u00e1\u0161\u00ed $GIT_DIR\/objects do c\u00edlov\u00e9ho adres\u00e1\u0159e a rozbaluje symbolick\u00e9 odkazy, co\u017e zp\u016fsobuje, \u017ee do c\u00edlov\u00e9ho adres\u00e1\u0159e se kop\u00edruj\u00ed p\u0159\u00edmo soubory, na kter\u00e9 odkazy ukazuj\u00ed. P\u0159epnut\u00ed na pou\u017eit\u00ed m\u00edstn\u00edch optimalizac\u00ed klonov\u00e1n\u00ed pro nelok\u00e1ln\u00ed transport umo\u017e\u0148uje zneu\u017eit\u00ed zranitelnosti p\u0159i pr\u00e1ci s extern\u00edmi repozit\u00e1\u0159i (nap\u0159\u00edklad rekursivn\u00ed zahrnut\u00ed submodul\u016f p\u0159\u00edkazem &#171;git clone &#8212;recurse-submodules&#187; m\u016f\u017ee v\u00e9st k naklonov\u00e1n\u00ed \u0161kodliv\u00e9ho repozit\u00e1\u0159e zabalen\u00e9ho jako submodul v jin\u00e9m repozit\u00e1\u0159i).     <\/p>\n<li class=\"l\"> Zranitelnost CVE-2023-23946 umo\u017e\u0148uje p\u0159epsat obsah soubor\u016f mimo pracovn\u00ed adres\u00e1\u0159 prost\u0159ednictv\u00edm p\u0159ed\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9ho vstupu p\u0159\u00edkazu &#171;git apply&#187;. Nap\u0159\u00edklad k \u00fatoku m\u016f\u017ee doj\u00edt p\u0159i zpracov\u00e1n\u00ed v &#171;git apply&#187; p\u0159ipraven\u00fdch zlovoln\u00edkem patch\u016f. Aby bylo zablokov\u00e1no vytv\u00e1\u0159en\u00ed patchy soubor\u016f mimo pracovn\u00ed kopii, &#171;git apply&#187; blokuje zpracov\u00e1n\u00ed patch\u016f, kter\u00e9 se sna\u017e\u00ed zapsat soubor pomoc\u00ed symbolick\u00fdch odkaz\u016f. Ale tuto ochranu bylo mo\u017en\u00e9 obej\u00edt vytvo\u0159en\u00edm symbolick\u00e9ho odkazu jako prvn\u00edho.      <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58655\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 \u0438 2.30.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 &#171;git apply&#187;. \u041f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445 Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. \u0415\u0441\u043b\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106827","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 \u0438 2.30.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Git, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 \u0438 2.30.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-02-15T16:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-02-16T09:50:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v Gitu vedouc\u00ed k \u00faniku a p\u0159episu dat | ProHoster","description":"Byly zve\u0159ejn\u011bny opravy distribuovan\u00e9ho syst\u00e9mu spr\u00e1vy zdrojov\u00e9ho k\u00f3du Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 a 2.30.8, ve kter\u00fdch byly odstran\u011bny dv\u011b zranitelnosti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Git, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 \u0438 2.30.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-02-15T16:48:14+00:00","article:modified_time":"2023-02-16T09:50:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/106827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=106827"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/106827\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=106827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=106827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=106827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}