{"id":108095,"date":"2023-04-26T12:48:19","date_gmt":"2023-04-26T10:48:19","guid":{"rendered":"https:\/\/prohoster.info\/?p=108095"},"modified":"2023-04-27T10:34:32","modified_gmt":"2023-04-27T08:34:32","slug":"uyazvimosti-v-git-pozvolyayushhie-perezapisat-fajly-ili-vypolnit-svoj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-git-pozvolyayushhie-perezapisat-fajly-ili-vypolnit-svoj-kod","title":{"rendered":"Vulnerabilities in Git allow file overwrites or arbitrary code execution","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of the distributed version control system Git 2.40.1, 2.39.3, 2.38.5, 2.37.7, 2.36.6, 2.35.8, 2.34.8, 2.33.8, 2.32.7, 2.31.8, and 2.30.9 have been published, addressing five vulnerabilities. You can track package updates in distributions on the pages of Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. As a workaround to protect against vulnerabilities, it is recommended to avoid executing the command 'git apply --reject' when working with untrusted external patches and to check the contents of $GIT_DIR\/config before running the commands 'git submodule deinit', 'git config --rename-section', and 'git config --remove-section' when working with untrusted repositories. <\/p>\n
The vulnerability CVE-2023-29007 allows for injected settings into the configuration file $GIT_DIR\/config, which can be used to execute code on the system by specifying paths to executables in the core.pager, core.editor, and core.sshCommand directives. The vulnerability is caused by a logical error, where exceedingly long configuration values may be processed as the start of a new section when performing rename or delete operations on the configuration file. In practice, the exploitation of this vulnerability can be achieved by specifying extremely long submodule URLs, which are saved in the $GIT_DIR\/config file during initialization. These URLs can be interpreted as new settings when attempting to remove them with 'git submodule deinit'. <\/p>\n
The CVE-2023-25652 vulnerability allows the overwriting of file content outside the working tree when processing specially crafted patches with the command 'git apply --reject'. When attempting to execute a malicious patch through the 'git apply' command, which tries to write to a file via a symbolic link, the operation will be rejected. In Git 2.39.1, protection against symbolic link manipulation has been enhanced by blocking patches that create symbolic links and attempt to write through them. The essence of the vulnerability in question is that Git did not consider that a user might execute the 'git apply --reject' command to write rejected parts of a patch as files with the '.rej' extension, and an attacker can exploit this opportunity to write content to an arbitrary directory, subject to current access rights. <\/p>\n
In addition, three vulnerabilities that manifest only on the Windows platform have been fixed: CVE-2023-29012 (the search for the executable doskey.exe in the working directory of the repository when executing the 'Git CMD' command, which allows for the execution of custom code in the user's system), CVE-2023-25815 (buffer overflow when processing specially crafted localization files in gettext), and CVE-2023-29011 (the possibility of replacing the connect.exe file when working through SOCKS5). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"