{"id":105334,"date":"2022-10-19T15:37:13","date_gmt":"2022-10-19T13:37:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell"},"modified":"2022-10-19T15:37:13","modified_gmt":"2022-10-19T13:37:13","slug":"uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","title":{"rendered":"Vulnerabilities in Git that occur when cloning submodules and using git shell.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of the distributed version control system Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 have been published, addressing two vulnerabilities that arise when using the «git clone» command in «—recurse-submodules» mode with unverified repositories and in the interactive mode of «git shell». Updates of the packages in distributions can be tracked on the pages of Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. <\/p>\n
\n
CVE-2022-39253 — The vulnerability allows an attacker controlling the content of the cloned repository to access sensitive data on the user's system by placing symbolic links to relevant files in the $GIT_DIR\/objects directory of the cloned repository. The issue occurs only during local cloning (in «—local» mode, used when the target and source data for cloning are on the same partition) or when cloning a malicious repository packaged as a submodule in another repository (for example, during recursive inclusion of submodules with the command «git clone —recurse-submodules»).\n
The vulnerability is caused by the fact that in «—local» cloning mode, git transfers the contents of $GIT_DIR\/objects to the target directory (it creates hard links or copies of files), dereferencing symbolic links (i.e., in the end, the files pointed to by the links, not the symbolic links themselves, are copied to the target directory). To block the manifestation of the vulnerability in new Git releases, cloning of repositories in «—local» mode containing symbolic links in the $GIT_DIR\/objects directory has been prohibited. Additionally, the default value of the protocol.file.allow parameter has been changed to «user», which classifies cloning operations using the file:\/\/ protocol as insecure. <\/p>\n
CVE-2022-39260 \u2014 Integer overflow in the split_cmdline() function used by the 'git shell' command. This issue can be exploited to attack users who use 'git shell' as their login shell and have enabled interactive mode (creating a $HOME\/git-shell-commands file). Exploiting the vulnerability may lead to arbitrary code execution in the system when a specially crafted command larger than 2 GB is passed. <\/ul>\n