{"id":105334,"date":"2022-10-19T15:37:13","date_gmt":"2022-10-19T13:37:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell"},"modified":"2022-10-19T15:37:13","modified_gmt":"2022-10-19T13:37:13","slug":"uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","title":{"rendered":"Zranite\u013enosti v Git, ktor\u00e9 sa prejavuj\u00fa pri klonovan\u00ed submodulov a pou\u017e\u00edvan\u00ed git shell","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Boli vydan\u00e9 opravn\u00e9 verzie distribuovan\u00e9ho syst\u00e9mu spr\u00e1vy zdrojov\u00fdch k\u00f3dov Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 a 2.37.4, v ktor\u00fdch boli odstr\u00e1nen\u00e9 dve zranite\u013enosti, ktor\u00e9 sa prejavuj\u00fa pri pou\u017eit\u00ed pr\u00edkazu &#171;git clone&#187; v re\u017eime &#171;&#8212;recurse-submodules&#187; s neoveren\u00fdmi repozit\u00e1rmi a pri pou\u017eit\u00ed interakt\u00edvneho re\u017eimu pr\u00e1ce &#171;git shell&#187;. Sledujte vyd\u00e1vanie aktualiz\u00e1ci\u00ed bal\u00edkov v distrib\u00faci\u00e1ch na str\u00e1nkach Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD.      <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-39253 &#8212; zranite\u013enos\u0165 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi, ktor\u00fd ovl\u00e1da obsah klonovan\u00e9ho repozit\u00e1ra, z\u00edska\u0165 pr\u00edstup k d\u00f4vern\u00fdm \u00fadajom v syst\u00e9me pou\u017e\u00edvate\u013ea, prostredn\u00edctvom umiestnenia symbolick\u00fdch odkazov na zauj\u00edmav\u00e9 s\u00fabory v adres\u00e1ri $GIT_DIR\/objects klonovan\u00e9ho repozit\u00e1ra. Probl\u00e9m sa prejavuje iba pri lok\u00e1lnom klonovan\u00ed (v re\u017eime &#171;&#8212;local&#187;, ktor\u00fd sa pou\u017e\u00edva, ke\u010f s\u00fa cie\u013eov\u00e9 a zdrojov\u00e9 d\u00e1ta klonovania na rovnakom oddiele) alebo pri klonovan\u00ed malv\u00e9rov\u00e9ho repozit\u00e1ra, zabalen\u00e9ho v forme submodulu v inom repozit\u00e1ri (napr\u00edklad pri rekurz\u00edvnom zapnut\u00ed submodulov pr\u00edkazom &#171;git clone &#8212;recurse-submodules&#187;).\n<p>Zranite\u013enos\u0165 je vyvolan\u00e1 t\u00fdm, \u017ee v re\u017eime klonovania &#171;&#8212;local&#187;, git pres\u00fava obsah $GIT_DIR\/objects do cie\u013eov\u00e9ho adres\u00e1ra (vytv\u00e1ra tvrd\u00e9 odkazy alebo k\u00f3pie s\u00faborov), pri\u010dom vykon\u00e1va dereferencovanie symbolick\u00fdch odkazov (t.j. nakoniec sa do cie\u013eov\u00e9ho adres\u00e1ra kop\u00edruj\u00fa nie symbolick\u00e9 odkazy, ale priamo s\u00fabory, na ktor\u00e9 odkazy ukazuj\u00fa). Na zablokovanie prejavu zranite\u013enosti v nov\u00fdch vydaniach git je zak\u00e1zan\u00e9 klonovanie repozit\u00e1rov v re\u017eime &#171;&#8212;local&#187;, ktor\u00e9 obsahuj\u00fa symbolick\u00e9 odkazy v adres\u00e1ri $GIT_DIR\/objects. Okrem toho bola predvolen\u00e1 hodnota parametra protocol.file.allow zmenen\u00e1 na &#171;user&#187;, \u010do zara\u010fuje oper\u00e1cie klonovania s pou\u017eit\u00edm protokolu file:\/\/ medzi nebezpe\u010dn\u00e9.    <\/p>\n<li class=\"l\"> CVE-2022-39260 \u2014 celo\u010d\u00edslen\u00e9 prete\u010denie vo funkcii split_cmdline(), pou\u017eitej v pr\u00edkaze \u201egit shell\u201c. Probl\u00e9m m\u00f4\u017ee by\u0165 zneu\u017eit\u00fd na \u00fatok na pou\u017e\u00edvate\u013eov, ktor\u00ed pou\u017e\u00edvaj\u00fa \u201egit shell\u201c ako shell pri prihl\u00e1sen\u00ed a maj\u00fa zapnut\u00fd interakt\u00edvny re\u017eim (vytvoren\u00fd s\u00fabor $HOME\/git-shell-commands). Vyu\u017eitie zranite\u013enosti m\u00f4\u017ee vies\u0165 k vykonaniu \u013eubovo\u013en\u00e9ho k\u00f3du v syst\u00e9me pri zaslan\u00ed \u0161peci\u00e1lne form\u00e1tovan\u00e9ho pr\u00edkazu v\u00e4\u010d\u0161ieho ako 2 GB.    <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57940\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 \u0438 2.37.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u044b &#171;git clone&#187; \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 &#171;&#8212;recurse-submodules&#187; \u0441 \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c\u0438 \u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u044b &#171;git shell&#187;. \u041f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445 Debian, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105334","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 \u0438 2.37.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Git, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u043f\u0440\u0438 \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0443\u0431\u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 git shell | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 \u0438 2.37.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-10-19T13:37:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-10-19T13:37:13+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v Gite, ktor\u00e9 sa prejavuj\u00fa pri klonovan\u00ed submodulov a pou\u017e\u00edvan\u00ed git shell | ProHoster","description":"Boli zverejnen\u00e9 opravy rozdelen\u00e9ho syst\u00e9mu spr\u00e1vy zdrojov\u00fdch k\u00f3dov Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 a 2.37.4, v ktor\u00fdch boli odstr\u00e1nen\u00e9 dve zranite\u013enosti, ktor\u00e9 sa prejavovali.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Git, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u043f\u0440\u0438 \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0443\u0431\u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 git shell | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 \u0438 2.37.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-19T13:37:13+00:00","article:modified_time":"2022-10-19T13:37:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/105334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=105334"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/105334\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=105334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=105334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=105334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}