{"id":115816,"date":"2024-05-16T02:59:27","date_gmt":"2024-05-16T00:59:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye"},"modified":"2024-05-16T02:59:27","modified_gmt":"2024-05-16T00:59:27","slug":"pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye","title":{"rendered":"Cinci vulnerabilit\u0103\u021bi \u00een Git, dintre care una critic\u0103 \u0219i dou\u0103 periculoase","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Au fost publicate versiunile corective ale sistemului distribuit de control al versiunilor Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 \u0219i 2.39.4, \u00een care au fost remediate cinci vulnerabilit\u0103\u021bi. Cea mai grav\u0103 vulnerabilitate (CVE-2024-32002), care a fost clasificat\u0103 ca av\u00e2nd un nivel critic de pericol, permite execu\u021bia codului malicios atunci c\u00e2nd se cloneaz\u0103 un repository controlat de atacator prin comanda &#171;git clone&#187;.    <\/p>\n<p>Vulnerabilitatea se manifest\u0103 doar \u00een sistemele de fi\u0219iere care nu fac distinc\u021bia \u00eentre majuscule \u0219i minuscule \u0219i care suport\u0103 linkuri simbolice, cum ar fi cele folosite \u00een mod implicit \u00een Windows \u0219i macOS. Exploatarea se realizeaz\u0103 prin crearea unui submodul de director \u0219i a unui link simbolic care difer\u0103 doar prin cazul literelor, ceea ce permite scrierea de fi\u0219iere \u00een directorul .git\/, \u00een loc de directorul de lucru al submodului. Ob\u021bin\u00e2nd acces la scriere \u00een .git\/, atacatorul poate supra\u00eenlocui apelurile hook prin .git\/hooks \u0219i poate executa cod arbitrar \u00een timpul opera\u021biunii &#171;git clone&#187;.    <\/p>\n<p>Alte vulnerabilit\u0103\u021bi:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-32004 \u2014 un atacator \u00eentr-un sistem multi-utilizator poate preg\u0103ti un repository local special conceput pentru a determina execu\u021bia codului la clonarea acestuia. \u00cen special, atacatorul poate crea un repository local care arat\u0103 ca un clon par\u021bial, \u00een care lipse\u0219te un obiect specific. Clonarea acestui repository va duce la execu\u021bia codului cu drepturile utilizatorului care efectueaz\u0103 opera\u021biunea de clonare.\n<li class=\"l\"> CVE-2024-32465 \u2014 clonarea din arhive zip care con\u021bin un repository git complet, incluz\u00e2nd hook-uri \u00een directorul .git\/, va duce la execu\u021bia acestor hook-uri.\n<li class=\"l\"> CVE-2024-32020 \u2014 crearea de clone locale ale repository-ului pe acela\u0219i disc \u00eentr-un sistem multi-utilizator permite altor utilizatori s\u0103 schimbe fi\u0219ierele pentru care sunt utilizate leg\u0103turi dure.\n<li class=\"l\"> CVE-2024-32021 \u2014 clonarea unui repository local cu linkuri simbolice poate fi folosit\u0103 pentru a crea leg\u0103turi dure c\u0103tre fi\u0219iere arbitrare \u00een directorul objects\/.    <\/ul>\n<p>Pe l\u00e2ng\u0103 remedierile vulnerabilit\u0103\u021bilor \u00een noile versiuni, au fost propuse \u0219i c\u00e2teva modific\u0103ri destinate sporirii protec\u021biei \u00eempotriva vulnerabilit\u0103\u021bilor care conduc la execu\u021bia de cod de la distan\u021b\u0103 \u0219i care manipuleaz\u0103 linkurile simbolice \u00een timpul clon\u0103rii. De exemplu, git acum emite un avertisment \u00een prezen\u021ba linkurilor simbolice \u00een directorul .git\/. C\u0103r\u021bile c\u0103tre submodule pot con\u021bine acum doar directoare reale. \u00cen cazul unei intersec\u021bii \u00eentre linkurile simbolice \u0219i directoare, se vor procesa directoarele. La executarea \u201egit clone\u201d a fost ad\u0103ugat\u0103 o protec\u021bie \u00eempotriva execu\u021biei hook-urilor \u00een timpul clon\u0103rii \u0219i au fost \u00eent\u0103rite verific\u0103rile pentru parametrul core.hooksPath.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=61180\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 \u0438 2.39.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-32002), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 &#171;git clone&#187; \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u043d\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0445 \u0440\u0435\u0433\u0438\u0441\u0442\u0440 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115816","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 \u0438 2.39.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Git, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0434\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0438 \u0434\u0432\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 \u0438 2.39.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-05-16T00:59:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-05-16T00:59:27+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cinci vulnerabilit\u0103\u021bi \u00een Git, dintre care una critic\u0103 \u0219i dou\u0103 periculoase | ProHoster","description":"Au fost publicate versiuni corective pentru sistemul distribuit de gestionare a codului surs\u0103 Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 \u0219i 2.39.4, care rezolv\u0103 cinci vulnerabilit\u0103\u021bi.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Git, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0434\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0438 \u0434\u0432\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 \u0438 2.39.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/pyat-uyazvimostej-v-git-sredi-kotoryh-odna-kriticheskaya-i-dve-opasnye","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T00:59:27+00:00","article:modified_time":"2024-05-16T00:59:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115816","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 00:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:27:19","updated":"2026-01-23 00:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115816","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=115816"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115816\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=115816"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=115816"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=115816"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}