{"id":78706,"date":"2020-04-21T13:42:05","date_gmt":"2020-04-21T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti"},"modified":"2020-04-21T13:42:05","modified_gmt":"2020-04-21T11:42:05","slug":"obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","title":{"rendered":"Aktualizace Git s opravou dal\u0161\u00ed zranitelnosti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byly zve\u0159ejn\u011bny<\/a><\/noindex> Opr\u00e1vn\u011bn\u00ed opravy distribuovan\u00e9ho syst\u00e9mu spr\u00e1vy verz\u00ed Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 a 2.17.5, ve kter\u00fdch byla odstran\u011bna zranitelnost<\/a><\/noindex> (CVE-2020-11008<\/a><\/noindex>), p\u0159ipom\u00ednaj\u00edc\u00ed probl\u00e9m<\/a><\/noindex>, odstran\u011bnou minul\u00fd t\u00fdden. Nov\u00e1 zranitelnost tak\u00e9 ovliv\u0148uje zpracovatele «credential.helper» a je vyu\u017e\u00edv\u00e1na p\u0159i p\u0159enosu speci\u00e1ln\u011b form\u00e1tovan\u00e9ho URL, kter\u00e9 obsahuje znak nov\u00e9ho \u0159\u00e1dku, pr\u00e1zdn\u00fd hostitel nebo neup\u0159esn\u011bn\u00fd protokol \u017e\u00e1dosti. P\u0159i zpracov\u00e1n\u00ed tohoto typu URL credential.helper pos\u00edl\u00e1 informace o p\u0159ihla\u0161ovac\u00edch \u00fadaj\u00edch, kter\u00e9 neodpov\u00eddaj\u00ed po\u017eadovan\u00e9mu protokolu nebo hostiteli, ke kter\u00e9mu se adresuje.<\/p>\n

Na rozd\u00edl od p\u0159edchoz\u00edho probl\u00e9mu, b\u011bhem vyu\u017e\u00edv\u00e1n\u00ed nov\u00e9 zranitelnosti \u00fato\u010dn\u00edk nem\u016f\u017ee p\u0159\u00edmo ovl\u00e1dat hostitele, od kter\u00e9ho budou p\u0159ed\u00e1v\u00e1ny ciz\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje. To, kter\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje uniknou, z\u00e1vis\u00ed na zvl\u00e1\u0161tnostech zpracov\u00e1n\u00ed chyb\u011bj\u00edc\u00edho parametru «host» v credential.helper. Podstatou probl\u00e9mu je, \u017ee pr\u00e1zdn\u00e1 pole v URL jsou mnoh\u00fdmi zpracovateli credential.helper interpretov\u00e1na jako pokyny pro pou\u017eit\u00ed jak\u00fdchkoli p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f k aktu\u00e1ln\u00edmu po\u017eadavku. T\u00edmto zp\u016fsobem credential.helper m\u016f\u017ee poslat na server \u00fato\u010dn\u00edka uveden\u00fd v URL p\u0159ihla\u0161ovac\u00ed \u00fadaje ulo\u017een\u00e9 pro jin\u00fd server. <\/p>\n

Probl\u00e9m se projevuje p\u0159i prov\u00e1d\u011bn\u00ed operac\u00ed, jako je «git clone» a «git fetch», ale je nejnebezpe\u010dn\u011bj\u0161\u00ed p\u0159i zpracov\u00e1n\u00ed submodul\u016f \u2014 p\u0159i prov\u00e1d\u011bn\u00ed «git submodule update» se automaticky zpracov\u00e1vaj\u00ed URL uveden\u00e9 v souboru .gitmodules z repozit\u00e1\u0159e. Jako obchvat pro blokov\u00e1n\u00ed probl\u00e9mu se doporu\u010duje<\/a><\/noindex> nen\u00ed pou\u017e\u00edvat credential.helper p\u0159i p\u0159\u00edstupu k ve\u0159ejn\u00fdm repozit\u00e1\u0159\u016fm a nepou\u017e\u00edvat «git clone» v re\u017eimu «—recurse-submodules» s neov\u011b\u0159en\u00fdmi repozit\u00e1\u0159i. <\/p>\n

Na nov\u00e9 verze Git oprava<\/a><\/noindex> zakazuje vol\u00e1n\u00ed credential.helper pro URL, kter\u00e9 obsahuj\u00ed nep\u0159edstaviteln\u00e9 hodnoty<\/a><\/noindex> (nap\u0159\u00edklad p\u0159i uveden\u00ed t\u0159\u00ed lom\u00edtek m\u00edsto dvou — «http:\/\/host» nebo bez ur\u010den\u00ed protokolu — «http::ftp.example.com»). Probl\u00e9m ovliv\u0148uje zpracovatele store (vestav\u011bn\u00e1 \u00falo\u017ei\u0161t\u011b p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f Git), cache (vestav\u011bn\u00e1 mezipam\u011b\u0165 zadan\u00fdch p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f) a osxkeychain (\u00falo\u017ei\u0161t\u011b pro macOS). Zpracovatel Git Credential Manager (\u00falo\u017ei\u0161t\u011b pro Windows) tento probl\u00e9m neovliv\u0148uje.<\/p>\n

Sledovat vyd\u00e1n\u00ed aktualizac\u00ed bal\u00ed\u010dk\u016f v distribuc\u00edch lze na str\u00e1nk\u00e1ch Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, ALT<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 \u0438 2.17.5, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-11008), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 «credential.helper» \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u0443\u0441\u0442\u043e\u0439 \u0445\u043e\u0441\u0442 \u0438\u043b\u0438 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78706","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualizace Gitu s odstran\u011bn\u00edm dal\u0161\u00ed zranitelnosti | ProHoster","description":"Byly vyd\u00e1ny opr\u00e1vn\u011bn\u00ed opravy distribuovan\u00e9ho syst\u00e9mu spr\u00e1vy verz\u00ed Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0435\u0449\u0451 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-21T11:42:05+00:00","article:modified_time":"2020-04-21T11:42:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78706","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:52:32","updated":"2022-10-01 02:38:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78706","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=78706"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78706\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=78706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=78706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=78706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}