{"id":78706,"date":"2020-04-21T13:42:05","date_gmt":"2020-04-21T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti"},"modified":"2020-04-21T13:42:05","modified_gmt":"2020-04-21T11:42:05","slug":"obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","title":{"rendered":"Aktualizacja Gita eliminuj\u0105ca jeszcze jedn\u0105 podatno\u015b\u0107","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Opublikowano<\/a><\/noindex> Koryguj\u0105ce wydania rozproszonego systemu zarz\u0105dzania kodem \u017ar\u00f3d\u0142owym Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 i 2.17.5, w kt\u00f3rych usuni\u0119to. luka<\/a><\/noindex> (CVE-2020-11008<\/a><\/noindex>), przypominaj\u0105ca problem<\/a><\/noindex>, usuni\u0119t\u0105 w ubieg\u0142ym tygodniu. Nowa luka dotycz\u0105ca r\u00f3wnie\u017c handler\u00f3w «credential.helper» i jest wykorzystywana przy przesy\u0142aniu specjalnie sformatowanego adresu URL, zawieraj\u0105cego znak nowej linii, pusty host lub nieokre\u015blon\u0105 schem\u0119 zapytania. Przy przetwarzaniu takiego adresu URL credential.helper przesy\u0142a informacje o po\u015bwiadczeniach, kt\u00f3re nie odpowiadaj\u0105 \u017c\u0105danym protoko\u0142owi lub hostowi, do kt\u00f3rego nast\u0119puje odwo\u0142anie.<\/p>\n

W przeciwie\u0144stwie do wcze\u015bniejszego problemu, w przypadku nowej luki, atakuj\u0105cy nie mo\u017ce bezpo\u015brednio kontrolowa\u0107 hosta, od kt\u00f3rego b\u0119d\u0105 przesy\u0142ane cudze po\u015bwiadczenia. To, jakie po\u015bwiadczenia wyciekaj\u0105, zale\u017cy od specyfiki przetwarzania brakuj\u0105cego parametru «host» w credential.helper. Istota problemu polega na tym, \u017ce puste pola w adresie URL s\u0105 interpretowane przez wiele handler\u00f3w credential.helper jako instrukcje do zastosowania do bie\u017c\u0105cego odwo\u0142ania wszelkich po\u015bwiadcze\u0144. W ten spos\u00f3b credential.helper mo\u017ce przes\u0142a\u0107 na wskazany w adresie URL serwer atakuj\u0105cego po\u015bwiadczenia, kt\u00f3re s\u0105 zapisane dla innego serwera. <\/p>\n

Problem ujawnia si\u0119 podczas wykonywania takich operacji jak «git clone» i «git fetch», ale jest najbardziej niebezpieczny podczas przetwarzania submodu\u0142\u00f3w \u2014 przy wykonywaniu «git submodule update» automatycznie przetwarzane s\u0105 adresy URL podane w pliku .gitmodules z repozytorium. Jako obej\u015bcie problemu zaleca si\u0119<\/a><\/noindex> nie nale\u017cy stosowa\u0107 credential.helper podczas odwo\u0142a\u0144 do publicznych repozytori\u00f3w i unika\u0107 u\u017cywania «git clone» w trybie «—recurse-submodules» z niezweryfikowanymi repozytoriami. <\/p>\n

Zalecane w nowych wydaniach Git poprawk\u0119<\/a><\/noindex> zakazuje wywo\u0142ywania credential.helper dla URL, kt\u00f3re zawieraj\u0105 nieprzewidywalne warto\u015bci<\/a><\/noindex> (na przyk\u0142ad przy podaniu trzech uko\u015bnik\u00f3w zamiast dw\u00f3ch \u2014 «http:\/\/host» lub bez schemy protoko\u0142u \u2014 «http::ftp.example.com\/»). Problem dotyczy handler\u00f3w store (wbudowane zbiorcze przechowywanie po\u015bwiadcze\u0144 Git), cache (wbudowany cache wpisanych po\u015bwiadcze\u0144) oraz osxkeychain (przechowalnia dla macOS). Handler Git Credential Manager (przechowalnia dla Windows) nie jest podatny na t\u0119 luk\u0119.<\/p>\n

Mog\u0105 Pa\u0144stwo \u015bledzi\u0107 wydanie aktualizacji pakiet\u00f3w w dystrybucjach na stronach Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, ALT<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

\u0179r\u00f3d\u0142o: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 \u0438 2.17.5, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-11008), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 «credential.helper» \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u0443\u0441\u0442\u043e\u0439 \u0445\u043e\u0441\u0442 \u0438\u043b\u0438 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78706","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualizacja Gita z poprawk\u0105 kolejnej luki bezpiecze\u0144stwa | ProHoster","description":"Opublikowane zosta\u0142y koryguj\u0105ce wydania rozproszonego systemu zarz\u0105dzania kodem \u017ar\u00f3d\u0142owym Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Git \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0435\u0449\u0451 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.2, 2.25.4, 2.24.3, 2.23.3.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-git-s-ustraneniem-eshhyo-odnoj-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-21T11:42:05+00:00","article:modified_time":"2020-04-21T11:42:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78706","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:52:32","updated":"2022-10-01 02:38:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/78706","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=78706"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/78706\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=78706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=78706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=78706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}