{"id":100021,"date":"2021-04-25T10:22:49","date_gmt":"2021-04-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda"},"modified":"2021-04-25T10:22:49","modified_gmt":"2021-04-25T08:22:49","slug":"uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","title":{"rendered":"Vulnerabilit\u00e0 in Git per Cygwin che consente l'esecuzione di codice","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In Git \u00e8 stata scoperta una vulnerabilit\u00e0 critica (CVE-2021-29468), che si manifesta solo durante la compilazione per l'ambiente Cygwin (una libreria per l'emulazione delle API Linux di base su Windows e un insieme di programmi Linux standard per Windows). La vulnerabilit\u00e0 consente l'esecuzione di codice malevolo durante il recupero di dati ('git checkout') da un repository controllato dall'attaccante. Il problema \u00e8 stato risolto nel pacchetto git 2.31.1-2 per Cygwin. Nel progetto principale di Git, il problema non \u00e8 ancora stato corretto (\u00e8 improbabile che qualcuno compili manualmente git per Cygwin, invece di utilizzare un pacchetto preconfezionato). <\/p>\n

La vulnerabilit\u00e0 \u00e8 causata dall'elaborazione dell'ambiente Cygwin come sistema Unix-like invece che Windows, il che porta all'assenza di restrizioni sull'uso del carattere \u2018\\\u2019 nel percorso, mentre in Cygwin, cos\u00ec come in Windows, questo carattere pu\u00f2 essere utilizzato per separare le directory. Di conseguenza, creando un repository appositamente modificato contenente collegamenti simbolici e file con il carattere backslash, \u00e8 possibile sovrascrivere file arbitrari durante il caricamento di questo repository in Cygwin (in Git per Windows, una vulnerabilit\u00e0 simile \u00e8 stata corretta nel 2019). Ottenendo la possibilit\u00e0 di sovrascrivere file, l'attaccante pu\u00f2 ridefinire le chiamate hook in git e eseguire codice arbitrario nel sistema.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Git \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29468), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f Cygwin (\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0434\u043b\u044f \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e Linux API \u0432 Windows \u0438 \u043d\u0430\u0431\u043e\u0440 \u0442\u0438\u043f\u043e\u0432\u044b\u0445 linux-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0434\u043b\u044f Windows). \u0423\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 («git checkout») \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 git 2.31.1-2 \u0434\u043b\u044f Cygwin. \u0412 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Git \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100021","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in Git per Cygwin che consente l'esecuzione di codice | ProHoster","description":"In Git \u00e8 stata individuata una vulnerabilit\u00e0 critica (CVE-2021-29468) che si manifesta solo quando si compila per l'ambiente Cygwin (una libreria per l'emulazione dell'API Linux di base in Windows e un insieme di programmi linux standard per Windows).","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Git \u0434\u043b\u044f Cygwin, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 Git \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29468), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f Cygwin (\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0434\u043b\u044f \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e Linux API \u0432 Windows \u0438 \u043d\u0430\u0431\u043e\u0440 \u0442\u0438\u043f\u043e\u0432\u044b\u0445 linux-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0434\u043b\u044f Windows).","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-25T08:22:49+00:00","article:modified_time":"2021-04-25T08:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100021","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-25 08:48:47","updated":"2022-10-05 17:52:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100021"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100021\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}