{"id":78706,"date":"2020-04-21T13:42:05","date_gmt":"2020-04-21T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti"},"modified":"2020-04-21T13:42:05","modified_gmt":"2020-04-21T11:42:05","slug":"obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","title":{"rendered":"Mise \u00e0 jour de Git avec la correction d'une autre vuln\u00e9rabilit\u00e9","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publi\u00e9<\/a><\/noindex> Des mises \u00e0 jour correctives pour le syst\u00e8me de gestion de versions distribu\u00e9 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 et 2.17.5, dans lesquelles a \u00e9t\u00e9 r\u00e9solu CVE-2020-10174<\/a><\/noindex> (CVE-2020-11008<\/a><\/noindex>), semblable \u00e0 le probl\u00e8me<\/a><\/noindex>, corrig\u00e9e la semaine derni\u00e8re. La nouvelle vuln\u00e9rabilit\u00e9 concerne \u00e9galement les gestionnaires \u00ab credential.helper \u00bb et est exploit\u00e9e lors de la transmission d'une URL sp\u00e9cialement form\u00e9e, contenant un caract\u00e8re de nouvelle ligne, un h\u00f4te vide ou un sch\u00e9ma de requ\u00eate non sp\u00e9cifi\u00e9. Lors du traitement d'une telle URL, credential.helper envoie des informations d'identification qui ne correspondent pas au protocole ou \u00e0 l'h\u00f4te demand\u00e9.<\/p>\n

Contrairement au probl\u00e8me pr\u00e9c\u00e9dent, lors de l'exploitation de la nouvelle vuln\u00e9rabilit\u00e9, l'attaquant ne peut pas contr\u00f4ler directement l'h\u00f4te \u00e0 partir duquel des informations d'identification \u00e9trang\u00e8res seront transmises. Les informations d'identification qui fuiteront d\u00e9pendent du traitement du param\u00e8tre 'host' manquant dans credential.helper. Le c\u0153ur du probl\u00e8me r\u00e9side dans le fait que des champs vides dans l'URL sont interpr\u00e9t\u00e9s par de nombreux gestionnaires credential.helper comme des instructions pour appliquer \u00e0 la requ\u00eate actuelle toutes les informations d'identification. Ainsi, credential.helper peut envoyer aux serveurs de l'attaquant des informations d'identification enregistr\u00e9es pour un autre serveur. <\/p>\n

Le probl\u00e8me se manifeste lors de l'ex\u00e9cution d'op\u00e9rations telles que \u00ab git clone \u00bb et \u00ab git fetch \u00bb, mais est le plus dangereux lors du traitement des sous-modules \u2014 lors de l'ex\u00e9cution de \u00ab git submodule update \u00bb, les URL sp\u00e9cifi\u00e9es dans le fichier .gitmodules du d\u00e9p\u00f4t sont automatiquement trait\u00e9es. Comme solution pour bloquer le probl\u00e8me il est recommand\u00e9<\/a><\/noindex> il est recommand\u00e9 de ne pas utiliser credential.helper lors de l'acc\u00e8s \u00e0 des d\u00e9p\u00f4ts publics et de ne pas appliquer \u00ab git clone \u00bb en mode \u00ab --recurse-submodules \u00bb avec des d\u00e9p\u00f4ts non v\u00e9rifi\u00e9s. <\/p>\n

Dans les nouvelles versions de Git la correction<\/a><\/noindex> il est interdit d'appeler credential.helper pour des URL contenant des valeurs inappropri\u00e9es<\/a><\/noindex> (par exemple, en sp\u00e9cifiant trois barres obliques au lieu de deux \u2014 \u00ab http:\/\/\/host \u00bb ou sans sch\u00e9ma de protocole \u2014 \u00ab http::ftp.example.com\/ \u00bb). Le probl\u00e8me affecte les gestionnaires store (stockage int\u00e9gr\u00e9 des informations d'identification Git), cache (cache int\u00e9gr\u00e9 des informations d'identification saisies) et osxkeychain (stockage pour macOS). Le gestionnaire Git Credential Manager (stockage pour Windows) n'est pas vuln\u00e9rable.<\/p>\n

Vous pouvez suivre la publication des mises \u00e0 jour des paquets dans les distributions sur les pages Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, ALT<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 \u0438 2.17.5, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-11008), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 «credential.helper» \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u0443\u0441\u0442\u043e\u0439 \u0445\u043e\u0441\u0442 \u0438\u043b\u0438 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78706","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour de Git pour corriger une nouvelle vuln\u00e9rabilit\u00e9 | ProHoster","description":"Des mises \u00e0 jour correctives pour le syst\u00e8me de gestion de versions distribu\u00e9 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3 ont \u00e9t\u00e9 publi\u00e9es.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0435\u0449\u0451 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-21T11:42:05+00:00","article:modified_time":"2020-04-21T11:42:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78706","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:52:32","updated":"2022-10-01 02:38:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/78706","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=78706"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/78706\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=78706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=78706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=78706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}