{"id":121349,"date":"2025-01-15T15:46:07","date_gmt":"2025-01-15T13:46:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-uyazvimostej"},"modified":"2025-01-15T15:46:07","modified_gmt":"2025-01-15T13:46:07","slug":"obnovlenie-git-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-uyazvimostej","title":{"rendered":"Aktualizacja Git z usuni\u0119ciem luk bezpiecze\u0144stwa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Opublikowano poprawki do rozproszonego systemu kontroli wersji Kod\u00f3w \u0179r\u00f3d\u0142owych Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2 i 2.48.1, w kt\u00f3rych usuni\u0119to dwie luki:    <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-50349 \u2014 mo\u017cliwo\u015b\u0107 podmiany informacji w interaktywnym \u017c\u0105daniu has\u0142a do repozytorium. Problem wynika z braku odpowiedniej weryfikacji nazwy hosta, co pozwala\u0142o na kodowanie znak\u00f3w w formacie %xx (URL Encoding). Atakuj\u0105cy m\u00f3g\u0142 wykorzysta\u0107 kodowanie procentowe, aby doda\u0107 do nazwy hosta sekwencje escape, manipuluj\u0105ce wyj\u015bciem na terminalu.\n<p>W ten spos\u00f3b mo\u017cna zmieni\u0107 tekst monitu o uwierzytelnienie i stworzy\u0107 u\u017cytkownikowi wra\u017cenie, \u017ce ma do czynienia z innym repozytorium, aby przy pr\u00f3bie dost\u0119pu do repozytorium atakuj\u0105cego u\u017cytkownik wpisa\u0142 login i has\u0142o z innego hosta. Atak mo\u017ce by\u0107 przeprowadzony podczas wykonywania rekurencyjnego klonowania submodu\u0142\u00f3w komend\u0105 \u201egit clone \u2014recurse-submodules\u201d, w wyniku czego jeden z submodu\u0142\u00f3w mo\u017ce za\u017c\u0105da\u0107 has\u0142a z innego hosta, ale dane wej\u015bciowe zostan\u0105 wys\u0142ane do hosta z repozytorium atakuj\u0105cego.      <\/p>\n<li class=\"l\"> CVE-2024-52006 \u2014 w implementacji protoko\u0142u \u201ecredential helper\u201d, wykorzystywanego do przesy\u0142ania po\u015bwiadcze\u0144 podczas dost\u0119pu do repozytori\u00f3w z ograniczonym dost\u0119pem, wykryto niedoci\u0105gni\u0119cie, kt\u00f3re pozwala na wstawienie do danych znaku powrotu karetki przez wskazanie specjalnie sformatowanego URL. Poniewa\u017c protok\u00f3\u0142 manipuluje danymi wiersz po wierszu, dodanie powrotu karetki mo\u017ce zosta\u0107 wykorzystane do rozdzielenia blok\u00f3w danych i zorganizowania przesy\u0142ania has\u0142a w niew\u0142a\u015bciwe miejsce. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pl\/server\/\"   title=\"serwer\" data-wpil-keyword-link=\"linked\">serwer<\/a>Mo\u017cliwo\u015b\u0107 przeprowadzenia ataku zale\u017cy od interpretacji znaku powrotu karetki jako separatora linii w r\u00f3\u017cnych implementacjach protoko\u0142u \u201ecredential helper\u201d. Na przyk\u0142ad problem dotyczy Git Credential Manager, napisanego w C#\/.NET.    <\/ul>\n<p>U\u017cytkownikom, kt\u00f3rzy nie maj\u0105 mo\u017cliwo\u015bci aktualizacji Git, zaleca si\u0119 powstrzymanie si\u0119 od dost\u0119pu do niezweryfikowanych zewn\u0119trznych repozytori\u00f3w za pomoc\u0105 polecenia \u201egit clone\u201d z flag\u0105 \u201e\u2014recurse-submodules\u201d, a tak\u017ce wykluczenie korzystania z mened\u017cer\u00f3w po\u015bwiadcze\u0144 przy klonowaniu publicznych repozytori\u00f3w. Opr\u00f3cz samego Gita, poprawki do zablokowania tych luk zosta\u0142y wydane dla GitHub Desktop (CVE-2025-23040), Git LFS (CVE-2024-53263) i Git Credential Manager (CVE-2024-50338).<br \/>\n<br \/>\u0179r\u00f3d\u0142o: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62561\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2 \u0438 2.48.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2024-50349 &#8212; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0435 \u043f\u0430\u0440\u043e\u043b\u044f \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u0438\u0440\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438\u043c\u0435\u043d\u0438 \u0445\u043e\u0441\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u043e\u0441\u044c \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 %xx (URL Encoding). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043d\u043e\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121349","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2 \u0438 2.48.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: .\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2 \u0438 2.48.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: .\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-01-15T13:46:07+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-01-15T13:46:07+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualizacja Gita z usuni\u0119ciem luk w zabezpieczeniach | ProHoster","description":"Opublikowane zosta\u0142y poprawki do rozproszon\u0105 systemu kontroli wersji Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2 i 2.48.1, w kt\u00f3rych usuni\u0119to dwie podatno\u015bci: .","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2 \u0438 2.48.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: .","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-15T13:46:07+00:00","article:modified_time":"2025-01-15T13:46:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121349","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:41:40","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:41:40","updated":"2026-01-23 09:41:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=121349"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121349\/revisions"}],"predecessor-version":[{"id":173019,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121349\/revisions\/173019"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=121349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=121349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=121349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}