{"id":106404,"date":"2023-01-19T06:48:10","date_gmt":"2023-01-19T04:48:10","guid":{"rendered":"https:\/\/prohoster.info\/?p=106404"},"modified":"2023-01-19T14:02:40","modified_gmt":"2023-01-19T12:02:40","slug":"dve-uyazvimosti-v-git-sposobnye-privesti-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dve-uyazvimosti-v-git-sposobnye-privesti-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"Two vulnerabilities in Git that can lead to remote code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases for the distributed version control system Git 2.39.1, 2.38.3, 2.37.5, 2.36.4, 2.35.6, 2.34.6, 2.33.6, 2.32.5, 2.31.6, and 2.30.7 have been published, addressing two vulnerabilities that allow the execution of arbitrary code on a user's system when using the 'git archive' command and working with untrusted external repositories. The vulnerabilities are caused by errors in formatting commit messages and parsing the '.gitattributes' file, which can lead to out-of-bounds memory writes and arbitrary memory reads when processing external repositories. <\/p>\n
Both vulnerabilities were identified during a security audit of the Git codebase carried out by X41 at the request of the OSTIF (Open Source Technology Improvement Fund), established to enhance the security of open-source projects. In addition to the two critical issues discussed below, the audit also identified one dangerous vulnerability, one medium-severity vulnerability, and four non-critical issues. Additionally, 27 recommendations for improving the security of the codebase were provided. <\/p>\n
\n
CVE-2022-41903: An integer overflow in the commit information formatting code occurs when handling large offset values in padding operators, such as '%<(', '%('), and '%>>('. The integer overflow arises in the format_and_pad_commit() function due to the use of the int type for the size_t variable, which is involved in determining the size of the copied block during the memcpy() call.\n
The vulnerability manifests both in direct calls with specially formatted parameters (for example, when running 'git log --format=\u2026'), and indirectly through formatting during the execution of the 'git archive' command in a repository under the attacker's control. In the latter case, formatting modifiers are specified via the export-subst parameter in the '.gitattributes' file, which can be placed by the attacker in their repository. This issue may be exploited to read from and write to arbitrary heap areas and can lead to the execution of the attacker\u2019s code when working with unverified repositories. <\/p>\n
CVE-2022-23521: Integer overflows when parsing the contents of '.gitattributes' files in a repository occur when processing a very large number of file path patterns or attributes with a single pattern, as well as when parsing extremely large attribute names. This issue can be exploited to read from and write to arbitrary heap areas and may result in the execution of the attacker\u2019s code when working with an unverified repository where the attacker can place a specially crafted .gitattributes file and ensure it gets indexed. <\/ul>\n
You can track the publication of package updates in distributions on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD, NetBSD. To reduce the risk of attacks when timely updates cannot be applied, it is advisable to refrain from working with untrustworthy repositories and from using the command 'git archive'. It is important to remember that the command 'git archive' can be triggered implicitly, for example, from git daemon. To disable the execution of 'git archive' in git daemon, the parameter daemon.uploadArch should be changed using the command 'git config --global daemon.uploadArch false'. <\/p>\n
Additionally, another vulnerability (CVE-2022-41953) in Git for Windows can be noted, which allows arbitrary code execution when cloning unverified external repositories through the graphical interface. The issue arises because the Git GUI for Windows automatically runs some post-processing commands, such as executing the spell-check program after the 'checkout' operation, where the spell-check file search paths also encompass the cloned working tree (the attack essentially involves adding spell-check to the working tree of the repository). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"