{"id":78706,"date":"2020-04-21T13:42:05","date_gmt":"2020-04-21T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti"},"modified":"2020-04-21T13:42:05","modified_gmt":"2020-04-21T11:42:05","slug":"obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","title":{"rendered":"Giti v\u00e4rskendus, mis lahendab veel \u00fche haavatavuse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud<\/a><\/noindex> korrektsed v\u00e4ljaanded hajutatud s\u00fcsteemide haldamiseks allikatekstide Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 ja 2.17.5, kus on k\u00f5rvaldatud haavatavus<\/a><\/noindex> (CVE-2020-11008<\/a><\/noindex>), meenutades probleem<\/a><\/noindex>, lahendatud eelmisel n\u00e4dalal. Uus haavatavus m\u00f5jutab ka \"credential.helper\" t\u00f6\u00f6tlejat ja seda saab \u00e4ra kasutada, kui edastada spetsiaalselt vormindatud URL, mis sisaldab uut rida, t\u00fchja hosti v\u00f5i m\u00e4\u00e4ramata p\u00e4ringu skeemi. Sarnase URL-i t\u00f6\u00f6tlemisel saadab credential.helper teavet mandaadi kohta, mis ei vasta n\u00f5utud protokollile v\u00f5i hostile, millele p\u00f6\u00f6rdutakse.<\/p>\n

Erinevalt eelmise probleemi korral ei saa r\u00fcndaja uue haavatavuse \u00e4rakasutamisel otse kontrollida hosti, millest edastatakse kolmandate osapoolte mandaadid. See, millised mandaadid lekitatakse, s\u00f5ltub credential.helperi t\u00fchja parameetri \"host\" t\u00f6\u00f6tlemise erip\u00e4radest. Probleemi tuum on see, et t\u00fchjad v\u00e4ljad URL-is t\u00f5lgendatakse paljude credential.helperi t\u00f6\u00f6tlejate poolt kui juhiseid k\u00f5igi mandaadide rakendamiseks praegusele p\u00e4ringule. Seet\u00f5ttu v\u00f5ib credential.helper edastada r\u00fcndaja m\u00e4\u00e4ratud serverile mandaadid, mis on salvestatud teisele serverile. <\/p>\n

Probleem ilmneb selliste toimingute k\u00e4igus nagu \"git clone\" ja \"git fetch\", kuid on k\u00f5ige ohtlikum alamoodulite t\u00f6\u00f6tlemisel \u2014 k\u00e4su \"git submodule update\" k\u00e4ivitamisel t\u00f6\u00f6tlevad automaatselt URL-e, mis on m\u00e4\u00e4ratud .gitmodules failis repozitooriumi seest. Probleemi v\u00e4ltimiseks on soovitatav mitte kasutada credential.helperit avalike repozitooriumide korral ja mitte rakendada \"git clone\" re\u017eiimis \"--recurse-submodules\" kontrollimata repozitooriumides. soovitatakse<\/a><\/noindex> n\u00e4iteks, kui m\u00e4\u00e4rata kolm kaldkriipsu kahe asemel \u2014 \"http:\/\/\/host\" v\u00f5i skeemi protokolli m\u00e4\u00e4ramata j\u00e4tmine \u2014 \"http::ftp.example.com\/\". Probleem m\u00f5jutab t\u00f6\u00f6tlejat store (Git'i sisseehitatud mandaadihaldus), cache (sisseehitatud sisestatud mandaadid) ja osxkeychain (macOSi mandaadihaldus). Git Credential Manager (Windowsi mandaadihaldus) ei ole haavatavusele allutatud. <\/p>\n

Uutes Git-i versioonides pakutud parandus<\/a><\/noindex> keelab credential.helper-i kutsumise URL-dele, mis sisaldavad vastuv\u00f5etamatud v\u00e4\u00e4rtused<\/a><\/noindex> (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0441\u043b\u044d\u0448\u0435\u0439 \u0432\u043c\u0435\u0441\u0442\u043e \u0434\u0432\u0443\u0445 — «http:\/\/\/host» \u0438\u043b\u0438 \u0431\u0435\u0437 \u0441\u0445\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 — «http::ftp.example.com\/»). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 store (\u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 Git), cache (\u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043a\u044d\u0448 \u0432\u0432\u0435\u0434\u0451\u043d\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445) \u0438 osxkeychain (\u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0434\u043b\u044f macOS). \u041e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Git Credential Manager (\u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0434\u043b\u044f Windows) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d.<\/p>\n

Pakettide v\u00e4rskenduste j\u00e4lgimiseks distributsioonides saab k\u00fclastada lehti Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, ALT<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 \u0438 2.17.5, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-11008), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 «credential.helper» \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u0443\u0441\u0442\u043e\u0439 \u0445\u043e\u0441\u0442 \u0438\u043b\u0438 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78706","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Git'i uuendamine, mis k\u00f5rvaldab veel \u00fche haavatavuse | ProHoster","description":"On avaldatud korrektsed v\u00e4ljaanded hajutatud s\u00fcsteemi k\u00e4itamiseks allikatekstide Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0435\u0449\u0451 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-21T11:42:05+00:00","article:modified_time":"2020-04-21T11:42:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78706","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:52:32","updated":"2022-10-01 02:38:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78706","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=78706"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78706\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=78706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=78706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=78706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}