{"id":53865,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnovlenie-git-s-ustraneniem-8-uyazvimostej"},"modified":"2020-02-18T14:01:48","modified_gmt":"2020-02-18T11:01:48","slug":"obnovlenie-git-s-ustraneniem-8-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-git-s-ustraneniem-8-uyazvimostej","title":{"rendered":"Git update patching 8 vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/lkml.org\/lkml\/2019\/12\/10\/905\">Published<\/a><\/noindex> Corrective releases of the distributed version control system Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, and 2.14.6 have addressed vulnerabilities that allow an attacker to rewrite arbitrary paths in the file system, arrange for remote code execution, or overwrite files in the directory '.git\/'. Most issues were identified by employees.<br \/>\nMicrosoft Security Response Center, five out of eight vulnerabilities are specific to the Windows platform.<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1348\">CVE-2019-1348<\/a><\/noindex> \u2014 Stream command 'feature export-marks=path'<noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=68061e3470210703cb15594194718d35094afdc0\">, rather than taking focus.<\/a><\/noindex> to write markers to arbitrary directories, which can be used to overwrite arbitrary paths in the FS when executing the 'git fast-import' operation with untrusted input.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1350\">CVE-2019-1350<\/a><\/noindex> \u2014 Incorrect escaping of command line arguments <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=6d8684161ee9c03bed5cb69ae76dfdddb85a0003\">could lead<\/a><\/noindex> leading to an attacker's remote code execution during recursive cloning using the ssh:\/\/ URL. In particular, the escaping of arguments ending with a backslash (for example, 'test \\') was incorrectly handled. In this case, when the argument was enclosed in double quotes, the last quote was escaped, allowing the substitution of their options in the command line.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1349\">CVE-2019-1349<\/a><\/noindex> \u2014 During recursive cloning of submodules ('clone --recurse-submodules') in a Windows environment under certain conditions <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=0060fd1511b94c918928fa3708f69a3f33895a4a\">it was possible<\/a><\/noindex> to initiate the use of a single git directory twice (.git, git~1, git~2, and git~N in NTFS is recognized as one directory, but this situation was only checked for git~1), which could be used to organize writing into the '.git' directory. To execute their code, an attacker could, for example, inject their script through a post-checkout hook in the .git\/config file.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1351\">CVE-2019-1351<\/a><\/noindex> \u2014 Handling of drive letter names in Windows paths when translating paths like 'C:\\' was designed only to replace single-letter Latin identifiers, but did not account for the creation of virtual drives assigned via 'subst letter:path'. Such paths were treated not as absolute but as relative paths, allowing the attacker's malicious repository to write to arbitrary directories outside the working tree (for instance, using numbers or unicode characters in the drive name \u2014 '1:\\what\\the\\hex.txt' or '\u00e4:\\tschib\u00e4t.sch').\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1352\">CVE-2019-1352<\/a><\/noindex> \u2014 when working on the Windows platform, the use of alternative data streams in NTFS, created by adding the attribute \u00ab:stream-name:stream-type\u00bb to the file name, <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=7c3745fc6185495d5765628b4dfe1bd2c25a2981\">allowed<\/a><\/noindex> overwriting files in the directory \u00ab.git\/\u00bb when cloning a malicious repository. For example, the name \u00ab.git::$INDEX_ALLOCATION\u00bb in NTFS was treated as a valid link to the directory \u00ab.git\u00bb.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1353\">CVE-2019-1353<\/a><\/noindex> \u2014 when using Git in the WSL (Windows Subsystem for Linux) environment, when accessing the working directory <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=9102f958ee5254b10c0be72672aa3305bf4f4704\">no protection was applied<\/a><\/noindex> protection against name manipulation in NTFS (attacks via FAT name translation were possible, for example, the directory \u00abgit~1\u00bb could be referenced to access \u00ab.git\u00bb).\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1354\">CVE-2019-1354<\/a><\/noindex> \u2014<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=e1d911dd4c7b76a5a8cec0f5c8de15981e34da83\">of<\/a><\/noindex> writing in the directory \u00ab.git\/\u00bb on the Windows platform when cloning malicious repositories containing files with a backslash in the name (for instance, \u00aba\u00bb), which is permissible in Unix\/Linux but is treated as part of the path in Windows.<\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1387\">CVE-2019-1387<\/a><\/noindex> \u2014 insufficient checking of submodule names could be exploited to conduct targeted attacks, which during recursive cloning could potentially <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/git\/git.git\/commit\/?id=a8dee3ca610f5a1d403634492136c887f83b59d2\">could lead<\/a><\/noindex> lead to the execution of the attacker's code. Git did not prohibit creating a submodule directory within another submodule's directory, which in most cases may only lead to confusion, but potentially does not exclude overwriting the contents of another module during the recursive cloning process (for example, submodule directories \u00abhippo\u00bb and \u00abhippo\/hooks\u00bb are placed as \u00ab.git\/modules\/hippo\/\u00bb and \u00ab.git\/modules\/hippo\/hooks\/\u00bb, while the hooks directory in hippo can be separately used to store executable handlers.\n<\/ul>\n<p>Windows users are strongly advised to urgently update their version of Git, and until the update, refrain from cloning untrusted repositories. If it is not possible to urgently update Git, to reduce the risk of attack, it is recommended not to run \u00abgit clone --recurse-submodules\u00bb and \u00abgit submodule update\u00bb with unverified repositories, not to use \u00abgit fast-import\u00bb with untrusted input streams, and not to clone repositories into NTFS-based partitions. <\/p>\n<p>For additional protection in new releases, the use of constructs in .gitmodules of the form \u00absubmodule.{name}.update=!command\u00bb is also prohibited. For distributions, users can monitor the release of package updates on the pages <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-1348\">Debian<\/a><\/noindex>,<noindex><a rel=\"nofollow\" href=\"https:\/\/people.canonical.com\/~ubuntu-security\/cve\/2019\/CVE-2019-1348.html\">Ubuntu<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2019-1348\">SUSE\/openSUSE<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2019-1348\">Arch<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1781955\">Alpine<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/security.archlinux.org\/CVE-2019-1348\">ALT<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/packages.altlinux.org\/ru\/p9\/security\">ALT<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"http:\/\/www.vuxml.org\/freebsd\/\">FreeBSD<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52010\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4 \u0438 2.14.62.24.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043f\u0443\u0442\u0438 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 &#171;.git\/&#187;. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u043c\u0438 Microsoft Security Response Center, \u043f\u044f\u0442\u044c \u0438\u0437 \u0432\u043e\u0441\u044c\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53865","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.24.1, 2.23.1, 2.22.2, 2.21.1.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-git-s-ustraneniem-8-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.24.1, 2.23.1, 2.22.2, 2.21.1.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-git-s-ustraneniem-8-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-11T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:48+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Git Update Fixing 8 Vulnerabilities | ProHoster","description":"Corrective releases of the distributed version control system Git 2.24.1, 2.23.1, 2.22.2, 2.21.1 have been published.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-git-s-ustraneniem-8-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.24.1, 2.23.1, 2.22.2, 2.21.1.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-git-s-ustraneniem-8-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53865","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:04:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:28","updated":"2026-01-24 09:04:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/53865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=53865"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/53865\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=53865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=53865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=53865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}