corrective releases of the distributed version control system Git 2.26.1, 2.25.3, 2.24.2, 2.23.2, 2.22.3, 2.21.2, 2.20.3, 2.19.4, 2.18.3, and 2.17.4, which fix () in the handler "", leading to credentials being sent to the wrong host when a git client accesses a repository via a specially crafted URL that contains a newline character. This vulnerability can be exploited to send credentials from another host to a server controlled by the attacker.
When specifying a URL like "https://evil.com?host=github.com/", the credentials handler connecting to the host evil.com will pass the authentication parameters set for github.com. This issue arises during operations such as "git clone", including when processing URLs for submodules (for example, when executing "git submodule update", the URLs defined in the .gitmodules file from the repository will be automatically processed). The vulnerability poses the greatest risk in situations where a developer clones a repository without seeing the URL, such as when working with submodules, or in systems that perform automated actions, like package build scripts.
To mitigate the vulnerability in new versions, newline characters in any values transmitted via the credential exchange protocol must be blocked. To track package update releases for distributions, one can visit the pages , , , , , , .
As a workaround for blocking the issue, avoid using credential.helper when accessing public repositories and do not use "git clone" in "--recurse-submodules" mode with unverified repositories. To fully disable the credential.helper handler, which performs and retrieving passwords from , secured or password files, you can use the following commands:
git config --unset credential.helper
git config --global --unset credential.helper
git config --system --unset credential.helper
Source: opennet.ru
