{"id":77984,"date":"2020-04-15T07:42:14","date_gmt":"2020-04-15T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh"},"modified":"2020-04-15T07:42:14","modified_gmt":"2020-04-15T05:42:14","slug":"uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","title":{"rendered":"Sicherheitsanf\u00e4lligkeit in Git, die zu Datenlecks f\u00fchrt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ver\u00f6ffentlicht<\/a><\/noindex> Korrekturen f\u00fcr die verteilte Versionierungssystem Git 2.26.1, 2.25.3, 2.24.2, 2.23.2, 2.22.3, 2.21.2, 2.20.3, 2.19.4, 2.18.3 und 2.17.4, in denen die eine Schwachstelle<\/a><\/noindex> (CVE-2020-5260<\/a><\/noindex>) im Handler «credential.helper<\/a><\/noindex>«, der dazu f\u00fchrt, dass Anmeldedaten nicht an den richtigen Host gesendet werden, wenn der Git-Client \u00fcber eine speziell formatierte URL mit einem Zeilenumbruchzeichen auf das Repository zugreift. Die Schwachstelle kann genutzt werden, um Anmeldedaten von einem anderen Host an einen Server, der vom Angreifer kontrolliert wird, zu senden. <\/p>\n

Wenn eine URL im Format \u201ehttps:\/\/evil.com?host=github.com\/\u201c angegeben wird, \u00fcbertr\u00e4gt der Anmeldehandler beim Verbinden mit dem Host evil.com die f\u00fcr github.com festgelegten Authentifizierungsparameter. Das Problem tritt bei der Ausf\u00fchrung solcher Operationen auf wie \u201egit clone\u201c, einschlie\u00dflich der Verarbeitung von URLs f\u00fcr Submodule (zum Beispiel werden bei der Ausf\u00fchrung von \u201egit submodule update\u201c die in der .gitmodules-Datei des Repositories festgelegten URLs automatisch verarbeitet). Die Schwachstelle stellt die gr\u00f6\u00dfte Gefahr dar in Situationen, in denen der Entwickler ein Repository klont, ohne die URL zu sehen, zum Beispiel bei der Arbeit mit Submodulen, oder in Systemen, die automatisierte Aktionen durchf\u00fchren, wie etwa in Paketbuild-Skripten.<\/p>\n

Um die Sicherheitsanf\u00e4lligkeit in neuen Versionen zu blockieren, ist verboten<\/a><\/noindex> das \u00dcbertragen von Zeilenumbruchzeichen in allen Werten, die \u00fcber das Protokoll f\u00fcr die Anmeldedaten\u00fcbertragung \u00fcbermittelt werden. Um sicherzustellen, dass die Aktualisierungen f\u00fcr die Distributionen bereitgestellt werden, k\u00f6nnen die Seiten Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\\\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

Als Umgehungsl\u00f6sung zur Blockierung des Problems wird empfohlen<\/a><\/noindex> vermeide die Verwendung von credential.helper beim Zugriff auf \u00f6ffentliche Repositories und verwende «git clone» nicht im «—recurse-submodules» Modus mit ungesicherten Repositories. Um den credential.helper vollst\u00e4ndig zu deaktivieren, der ausgef\u00fchrt wird, Speicherung<\/a><\/noindex> und Abruf von Passw\u00f6rtern aus dem Cache<\/a><\/noindex>, gesch\u00fctzt durch Speicher<\/a><\/noindex> oder eine Passwortdatei zu verwenden, k\u00f6nnen die folgenden Befehle ausgef\u00fchrt werden:<\/p>\n

git config —unset credential.helper
\n git config —global —unset credential.helper
\n git config —system —unset credential.helper<\/p>\n

<\/a><\/noindex><\/p>\n

Quelle: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.1, 2.25.3, 2.24.2, 2.23.2, 2.22.3, 2.21.2, 2.20.3, 2.19.4, 2.18.3 \u0438 2.17.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-5260) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 «credential.helper«, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u043d\u0430 \u0442\u043e\u0442 \u0445\u043e\u0441\u0442 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 git-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044e \u043f\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u043c\u0443 \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-77984","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sicherheitsanf\u00e4lligkeit in Git, die zu Datenlecks f\u00fchrt | ProHoster","description":"Korrekturen f\u00fcr die verteilte Versionierungssystem Git 2.26.1, 2.25.3, 2.24.2, 2.23.2 wurden ver\u00f6ffentlicht.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Git, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.1, 2.25.3, 2.24.2, 2.23.2.","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-15T05:42:14+00:00","article:modified_time":"2020-04-15T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"77984","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:07:27","updated":"2022-10-02 19:46:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/77984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=77984"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/77984\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=77984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=77984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=77984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}