{"id":106827,"date":"2023-02-15T18:48:14","date_gmt":"2023-02-15T16:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=106827"},"modified":"2023-02-16T11:50:36","modified_gmt":"2023-02-16T09:50:36","slug":"uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","title":{"rendered":"Vulnerabilities in Git leading to data leakage and overwriting","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases for the distributed version control system Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 have been published, which address two vulnerabilities affecting optimizations during local cloning and the «git apply» command. You can track the release of package updates in distributions on the pages of Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. If installing the update is not possible, as a workaround, it is recommended to avoid executing the «git clone» operation with the «—recurse-submodules» option on untrusted repositories, as well as to refrain from using the «git apply» and «git am» commands with unverified code. <\/p>\n
\n
The CVE-2023-22490 vulnerability allows an attacker controlling the contents of the cloned repository to gain access to sensitive data on the user's system. The vulnerability arises from two shortcomings:\n
The first shortcoming allows local cloning optimizations to be applied when working with specially crafted repositories, even when using transport that interacts with external systems. <\/p>\n
The second shortcoming allows the placement of a symbolic link instead of the $GIT_DIR\/objects directory, similar to the CVE-2022-39253 vulnerability, which blocked the placement of symbolic links in the $GIT_DIR\/objects directory but did not check that the $GIT_DIR\/objects directory itself could be a symbolic link. <\/p>\n
In local cloning mode, git transfers $GIT_DIR\/objects to the target directory, resolving symbolic links, which results in the direct copying of the files that the links point to into the target directory. Switching to apply local cloning optimizations for non-local transport enables the exploitation of a vulnerability when working with external repositories (for example, recursively including submodules with the «git clone —recurse-submodules» command can lead to cloning a malicious repository packaged as a submodule in another repository). <\/p>\n
The vulnerability CVE-2023-23946 allows for overwriting the contents of files outside the working directory by passing specially crafted input to the «git apply» command. For instance, an attack can be executed while processing attacker-prepared patches in «git apply». To prevent patches from creating files outside of the working copy, «git apply» blocks the processing of patches that attempt to write a file using symbolic links. However, this protection can be bypassed by first creating a symbolic link. <\/ul>\n