{"id":78706,"date":"2020-04-21T13:42:05","date_gmt":"2020-04-21T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti"},"modified":"2020-04-21T13:42:05","modified_gmt":"2020-04-21T11:42:05","slug":"obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","title":{"rendered":"Aggiornamento di Git che risolve un'altra vulnerabilit\u00e0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pubblicato<\/a><\/noindex> rilasci correttivi del sistema di controllo della versione distribuito Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 e 2.17.5, in cui \u00e8 stata risolta una vulnerabilit\u00e0<\/a><\/noindex> (CVE-2020-11008<\/a><\/noindex>), che ricorda il problema<\/a><\/noindex>, risolta la scorsa settimana. Una nuova vulnerabilit\u00e0 colpisce anche i gestori «credential.helper» ed \u00e8 sfruttata durante la trasmissione di un URL appositamente formattato, contenente un carattere di nuova riga, un host vuoto o uno schema di richiesta non specificato. Durante la gestione di un tale URL, credential.helper invia informazioni sulle credenziali che non corrispondono al protocollo o all'host richiesto.<\/p>\n

A differenza del problema precedente, nell'exploitation della nuova vulnerabilit\u00e0, l'attaccante non pu\u00f2 controllare direttamente l'host da cui verranno trasferite le credenziali compromesse. Le credenziali che verranno esposte dipendono dalle peculiarit\u00e0 della gestione del parametro mancante «host» in credential.helper. La questione \u00e8 che i campi vuoti nell'URL sono interpretati da molti gestori credential.helper come istruzioni per applicare a quella richiesta qualsiasi credenziale. In questo modo, credential.helper pu\u00f2 inviare al server dell'attaccante le credenziali conservate per un altro server. <\/p>\n

Il problema si manifesta durante operazioni come \u00abgit clone\u00bb e \u00abgit fetch\u00bb, ma \u00e8 particolarmente rischioso durante la gestione dei submoduli \u2014 eseguendo \u00abgit submodule update\u00bb, gli URL specificati nel file .gitmodules del repository vengono elaborati automaticamente. Come soluzione alternativa per bloccare il problema si raccomanda<\/a><\/noindex> non utilizzare credential.helper quando si accede a repository pubblici e non usare \u00abgit clone\u00bb in modalit\u00e0 \u00ab--recurse-submodules\u00bb con repository non verificati. <\/p>\n

Le nuove versioni di Git la correzione<\/a><\/noindex> vietano la chiamata a credential.helper per URL che contengono valori non rappresentabili<\/a><\/noindex> (ad esempio, specificando tre slash invece di due \u2014 \u00abhttp:\/\/\/host\u00bb o senza lo schema del protocollo \u2014 \u00abhttp::ftp.example.com\/\u00bb). Il problema coinvolge i gestori store (archivio integrato delle credenziali Git), cache (cache integrata delle credenziali inserite) e osxkeychain (archivio per macOS). Il gestore delle credenziali Git Credential Manager (archivio per Windows) non \u00e8 vulnerabile.<\/p>\n

Puoi tenere traccia degli aggiornamenti dei pacchetti nelle distribuzioni tramite le pagine Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, ALT<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 \u0438 2.17.5, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-11008), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 «credential.helper» \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u0443\u0441\u0442\u043e\u0439 \u0445\u043e\u0441\u0442 \u0438\u043b\u0438 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78706","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aggiornamento di Git con la risoluzione di un'altra vulnerabilit\u00e0 | ProHoster","description":"Sono stati rilasciati aggiornamenti correttivi per il sistema di gestione del codice sorgente distribuito Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 e 2.17.5, che risolvono una vulnerabilit\u00e0 (CVE-2020-11008), simile a un problema risolto la settimana scorsa. La nuova vulnerabilit\u00e0 interessa anche i gestori \"credential.helper\" e viene sfruttata durante la trasmissione di un URL appositamente formattato contenente un carattere di nuova riga, un host vuoto o uno schema di richiesta non specificato.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0435\u0449\u0451 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 \u0438 2.17.5, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-11008), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 "credential.helper" \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u0443\u0441\u0442\u043e\u0439 \u0445\u043e\u0441\u0442 \u0438\u043b\u0438 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430.","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-21T11:42:05+00:00","article:modified_time":"2020-04-21T11:42:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78706","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:52:32","updated":"2022-10-01 02:38:58"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/78706","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=78706"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/78706\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=78706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=78706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=78706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}