corrective releases of the distributed version control system Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4, and 2.17.5, in which the issue has been resolved (), reminiscent of , addressed last week. The new vulnerability also affects the "credential.helper" handlers and is exploited when transmitting a specially crafted URL containing a newline character, an empty host, or an unspecified request scheme. When processing such a URL, credential.helper sends credential information that does not match the requested protocol or host being accessed.
Unlike the previous issue, in exploiting the new vulnerability, the attacker cannot directly control the host from which credentials will be transmitted. The credentials that leak depend on how the missing "host" parameter is processed in credential.helper. The essence of the problem is that empty fields in the URL are interpreted by many credential.helper handlers as instructions to apply any stored credentials to the current request. Thus, credential.helper may send credentials saved for another server to the attacker's server specified in the URL.
The issue manifests itself during operations such as "git clone" and "git fetch," but is most dangerous when handling submodules — when executing "git submodule update," URLs specified in the .gitmodules file from the repository are automatically processed. As a workaround to block the issue not to use credential.helper when accessing public repositories and to avoid using "git clone" in "—recurse-submodules" mode with unverified repositories.
The fix proposed in the new Git releases unrepresentable values You can track the release of package updates in distributions on the pages of
RHEL , , , , , , , .
Source: opennet.ru
