Kusintha kwa Git ndi zovuta 8 zokhazikika

Lofalitsidwa kutulutsidwa kwa njira yoyendetsera gwero logawidwa Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4 ndi 2.14.62.24.1 . Mavuto ambiri amazindikiridwa ndi antchito
Microsoft Security Response Center, ziwopsezo zisanu mwa zisanu ndi zitatuzi ndizokhazikika papulatifomu ya Windows.

  • CVE-2019-1348 - kutulutsa lamulo "mawonekedwe a export-marks=njira"timatha lembani zolembera kuzinthu zosasinthika, zomwe zingagwiritsidwe ntchito kulembera njira zosagwirizana mu fayilo mukamachita ntchito ya "git-import" yokhala ndi deta yosasankhidwa.
  • CVE-2019-1350 - kuthawa kolakwika kwa mikangano yamalamulo akhoza kutsogolera Kukhazikitsa kutali kwa code yowukira panthawi yobwerezabwereza pogwiritsa ntchito ssh:// URL. Makamaka, kuthawa mikangano yomwe imathera m'mbuyo (mwachitsanzo, "test \") inagwiridwa molakwika. Pachifukwa ichi, poyambitsa mkangano ndi mawu awiri, mawu omaliza adathawa, zomwe zinapangitsa kuti zikhale zotheka kukonza m'malo mwa zosankha zanu pamzere wolamula.
  • CVE-2019-1349 - mukamapanga ma submodule mobwerezabwereza ("clone -recurse-submodules") m'malo a Windows pansi pamikhalidwe ina zikhoza kukhala yambitsani kugwiritsa ntchito git directory kawiri (.git, git~1, git~2 ndi git~N zimadziwika ngati chikwatu chimodzi mu NTFS, koma izi zidangoyesedwa git~1), zomwe zitha kugwiritsidwa ntchito kukonza kulembera ku chikwatu ". git". Kuti akonzekere kukhazikitsidwa kwa khodi yake, wowukira, mwachitsanzo, atha kuloΕ΅a m'malo mwa cholembera chake kudzera pa chowongolera potuluka mu fayilo ya .git/config.
  • CVE-2019-1351 - chogwiritsira ntchito mayina oyendetsa makalata m'mawindo a Windows pomasulira njira ngati "C:\" idapangidwa kuti ilowe m'malo mwa zilembo zachilatini za chilembo chimodzi, koma sanaganizirepo za kuthekera kopanga ma drive omwe amaperekedwa kudzera pa "kalata yaying'ono: njira" . Njira zotere sizinatengedwe ngati zenizeni, koma ngati njira zofananira, zomwe zidapangitsa kuti, popanga malo oyipa, kukonza zolembedwa m'mabuku osasinthika kunja kwa mtengo wowongolera (mwachitsanzo, mukamagwiritsa ntchito manambala kapena zilembo za unicode mu diski. dzina - "1:\what\the\ hex.txt" kapena "Γ€:\tschibΓ€t.sch").
  • CVE-2019-1352 - pogwira ntchito pa nsanja ya Windows, kugwiritsa ntchito njira zina zosinthira deta mu NTFS, zopangidwa powonjezera ": stream-name: stream-type" ku dzina la fayilo, kuloledwa lembani mafayilo mu ".git/" chikwatu popanga nkhokwe yoyipa. Mwachitsanzo, dzina ".git::$INDEX_ALLOCATION" mu NTFS lidawonedwa ngati ulalo wovomerezeka ku chikwatu cha ".git".
  • CVE-2019-1353 - mukamagwiritsa ntchito Git m'malo a WSL (Windows Subsystem for Linux) mukapeza bukhu logwira ntchito osagwiritsidwa ntchito chitetezo ku chinyengo cha dzina mu NTFS (zowukira kudzera mu kumasulira dzina la FAT zinali zotheka, mwachitsanzo, ".git" atha kupezeka kudzera mu bukhu la "git~1").
  • CVE-2019-1354 -
    mwayi amalemba ku ".git/" chikwatu pa Windows nsanja pamene cloning nkhokwe njiru okhala ndi owona ndi backslash m'dzina (mwachitsanzo, "a\b"), amene ali chovomerezeka pa Unix/Linux, koma amavomerezedwa ngati mbali ya njira pa Windows.

  • CVE-2019-1387 - kuyang'ana kosakwanira kwa mayina a submodule kungagwiritsidwe ntchito kukonza zigawenga zomwe, ngati zitasinthidwa mobwerezabwereza, zingatheke akhoza kutsogolera kupanga code ya wowukirayo. Git sanalepheretse kupanga chikwatu cha submodule mkati mwa chikwatu china cha submodule, chomwe nthawi zambiri chimangoyambitsa chisokonezo, koma sichinalepheretse zomwe zili mugawo lina kuti zisalembedwenso panthawi yobwerezabwereza (mwachitsanzo, zolemba za submodule). "mvuu" ndi "mvuu / mbedza" zaikidwa ngati " .git/modules/mvuu/" ndi ".git/modules/mvuu/mbeza/", ndipo bukhu la mbewa mu mvuu lingagwiritsidwe ntchito padera pochititsa mbedza zoyambitsidwa.

Ogwiritsa ntchito Windows akulangizidwa kuti asinthe nthawi yomweyo mtundu wawo wa Git, ndikupewa kupanga nkhokwe zosatsimikizirika mpaka zitasinthidwa. Ngati sikungatheke kusinthiratu mtundu wa Git mwachangu, ndiye kuti muchepetse chiwopsezo, tikulimbikitsidwa kuti musamayendetse "git clone -recurse-submodules" ndi "git submodule update" ndi nkhokwe zosasankhidwa, osagwiritsa ntchito "git". tumizani mwachangu" ndi mitsinje yolowera yosasankhidwa, osati kutengera nkhokwe ku magawo ozikidwa pa NTFS.

Kuti muwonjezere chitetezo, zatsopano zimaletsanso kugwiritsa ntchito mawonekedwe a "submodule.{name}.update=!command" mu .gitmodules. Kwa magawo, mutha kutsata kutulutsidwa kwa zosintha zamaphukusi patsamba Debian,Ubuntu, RHEL, SUSE/OpenSUSE, Fedora, Chipilala, ALT, FreeBSD.

Source: opennet.ru

Kuwonjezera ndemanga