Mmelite Git nwere adịghị ike 8 edoziri

Ebipụtara Mwepụta mmezi nke sistemụ njikwa isi iyi ekesa Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4 na 2.14.62.24.1 XNUMX, nke edozila adịghị ike nke nyere onye na-awakpo ohere idegharị ụzọ aka ike na sistemụ faịlụ, hazie mmebe koodu dịpụrụ adịpụ, ma ọ bụ degharịa faịlụ na ndekọ ".git/". Ọtụtụ nsogbu ndị ọrụ chọpụtara
Ebe Mmeghachi Omume Nchekwa Microsoft, ise n'ime adịghị ike asatọ ahụ bụ nke akọwapụtara na ikpo okwu. Windows.

  • CVE-2019-1348 - iwu nkwanye ugwu "njirimara mbupụ-marks=ụzọ"ọ na-enye ohere dee akara aka na akwụkwọ ndekọ aha aka ike, nke enwere ike iji degharịa ụzọ aka ike na sistemụ faịlụ mgbe ị na-arụ ọrụ "git fast-import" na-eji data ntinye enweghị akara.
  • CVE-2019-1350 - mgbanarị arụmụka ahịrị iwu na-ezighi ezi nwere ike idu iji gbuo koodu onye na-awakpo anya n'oge cloning recursive site na iji ssh: // URL. Karịsịa, a na-edozi mgbanarị arụmụka na-agwụ na azụ azụ (dịka ọmụmaatụ, "ule \") na-ezighi ezi. N'okwu a, mgbe ị na-emepụta arụmụka na okwu abụọ, okwu ikpeazụ gbanarị, nke mere ka o kwe omume ịhazi ngbanwe nke nhọrọ gị na ahịrị iwu.
  • CVE-2019-1349 — mgbe a na-emegharị ihe ndị dị n'okpuru (“clone —recurse-submodules”) n'ime gburugburu ebe obibi Windows n'okpuru ụfọdụ ọnọdụ o nwere ike ịbụ kpalite iji otu akwụkwọ ndekọ aha git ugboro abụọ (.git, git ~ 1, git ~ 2 na git ~ N ka a ghọtara dị ka otu ndekọ na NTFS, mana a nwalere ọnọdụ a naanị maka git ~ 1), nke enwere ike iji hazie ya. na-ede na ndekọ ". git". Iji hazie ogbugbu nke koodu ya, onye na-awakpo, dịka ọmụmaatụ, nwere ike dochie edemede ya site na onye na-ahụ maka ndenye ọpụpụ na faịlụ .git/config.
  • CVE-2019-1351 - onye njikwa aha mkpụrụedemede draịva n'ụzọ Windows Mgbe a na-asụgharị ụzọ dịka "C:\", e mere ya naanị iji dochie ihe njirimara Latin nke otu mkpụrụedemede, mana atụleghị ohere nke ịmepụta diski mebere emebere nke e kenyere site na "subst letter:path". A naghị ahazi ụzọ ndị dị otú ahụ dị ka ihe zuru oke, kama dị ka ụzọ ndị metụtara ya, nke na-ekwe ka, mgbe a na-eme ihe nchekwa ọjọọ, dee na ndekọ na-enweghị usoro n'èzí osisi ndekọ ọrụ (dịka ọmụmaatụ, mgbe a na-eji ọnụọgụgụ ma ọ bụ mkpụrụedemede Unicode na aha diski - "1:\what\the\hex.txt" ma ọ bụ "ä:\tschibät.sch").
  • CVE-2019-1352 - mgbe ị na-arụ ọrụ n'elu ikpo okwu Windows site na iji iyi data ndị ọzọ na NTFS, nke e kere site na itinye ọkọlọtọ ":stream-name:stream-type" na aha faịlụ ahụ, ekwe degharịa faịlụ na ndekọ ".git/" mgbe ị na-emechi ebe nchekwa ihe ọjọọ. Dịka ọmụmaatụ, a na-emeso aha ".git::$INDEX_ALLOCATION" na NTFS dị ka njikọ ziri ezi na ndekọ ".git".
  • CVE-2019-1353 - mgbe ị na-eji Git na gburugburu WSL (Windows Subsystem maka Linux) mgbe ị na-abanye na ndekọ ọrụ ejighi ya nchebe megide ntughari aha na NTFS (mwakpo sitere na ntụgharị aha FAT ga-ekwe omume, dịka ọmụmaatụ, ".git" nwere ike ịnweta site na ndekọ "git ~ 1").
  • CVE-2019-1354 -
    ohere ntinye dị na ndekọ ".git/" dị na ikpo okwu ahụ Windows mgbe ị na-eme ihe nchekwa ihe ọjọọ nke nwere faịlụ nwere akara azụ n'aha (dịka ọmụmaatụ "a\b"), nke a na-ekwe ka ọ dị na Unix/Linux, mana a na-ahụta ya dị ka akụkụ nke ụzọ isi Windows.
  • CVE-2019-1387 - Enwere ike iji nyocha ezughị oke nke submodule aha iji hazie mwakpo ezubere iche, nke, ọ bụrụ na emechie ya ugboro ugboro, nwere ike nwee ike. nwere ike idu iji mebie koodu onye mwakpo ahụ. Git egbochighị imepụta akwụkwọ ndekọ aha submodule n'ime ndekọ aha submodule ọzọ, nke n'ọtụtụ ọnọdụ ga-ebute naanị mgbagwoju anya, mana ọ nweghị ike igbochi ọdịnaya nke modul ọzọ ka edegharị ya n'oge usoro cloning na-emegharị (dịka ọmụmaatụ, akwụkwọ ntuziaka submodule). A na-edobe "hippo" na "hippo/hooks" dị ka ".git/modules/hippo/" na ".git/modules/hippo/hooks/", na ndekọ hooks dị na hippo nwere ike iji iche iche mee nko ndị kpalitere.

Maka ndị ọrụ Windows A na-atụ aro ka ị kwalite ụdị Git gị ngwa ngwa ma zere imechi ebe nchekwa ndị a na-atụkwasịghị obi ruo mgbe mmelite ahụ zuru. Ọ bụrụ na mmelite Git dị ngwa adịghị, iji belata ihe egwu nke mwakpo, a na-atụ aro ka ị ghara ịgba ọsọ "git clone --recurse-submodules" na "git submodule update" na ebe nchekwa ndị a na-atụkwasịghị obi, ka ị ghara iji "git fast-import" na ebe ntinye ndị a na-atụkwasịghị obi, ka ị gharakwa imechi ebe nchekwa ndị a na-etinyeghị aka na nkebi ndị dabere na NTFS.

Maka nchekwa agbakwunyere, mwepụta ọhụrụ machibidokwara iji ihe nrụpụta ụdị "submodule.{name}.update=!command" na .gitmodules. Maka nkesa, ị nwere ike soro mwepụta nke mmelite ngwugwu na ibe Debian,Ubuntu, RHEL, SUSE/mepeeSUSE, Fedora, Arch, ALT, FreeBSD.

isi: opennet.ru

Zụta nnabata ntụkwasị obi maka saịtị nwere nchekwa DDoS, sava VPS VDS 🔥 Zụta ebe nrụọrụ weebụ a pụrụ ịtụkwasị obi na nchekwa DDoS, sava VPS VDS | ProHoster