{"id":77984,"date":"2020-04-15T07:42:14","date_gmt":"2020-04-15T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh"},"modified":"2020-04-15T07:42:14","modified_gmt":"2020-04-15T05:42:14","slug":"uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","title":{"rendered":"Zranite\u013enos\u0165 v Gitu ved\u00faca k \u00faniku prihlasovac\u00edch \u00fadajov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Boli zverejnen\u00e9<\/a><\/noindex> opravy distribu\u010dn\u00e9ho syst\u00e9mu spr\u00e1vy zdrojov\u00fdch k\u00f3dov Git 2.26.1, 2.25.3, 2.24.2, 2.23.2, 2.22.3, 2.21.2, 2.20.3, 2.19.4, 2.18.3 a 2.17.4, v ktor\u00fdch bola odstr\u00e1nen\u00e1 zranite\u013enos\u0165<\/a><\/noindex> (CVE-2020-5260<\/a><\/noindex>) v spracovate\u013eovi \u00abcredential.helper<\/a><\/noindex>\u00ab, ktor\u00e1 vedie k odoslaniu poveren\u00ed na nespr\u00e1vny hostite\u013e pri pr\u00edstupe git klienta k \u00falo\u017eisku cez \u0161peci\u00e1lne naform\u00e1tovan\u00fa URL, ktor\u00e1 obsahuje znak nov\u00e9ho riadku. Zranite\u013enos\u0165 sa m\u00f4\u017ee vyu\u017ei\u0165 na odoslanie poveren\u00ed z in\u00e9ho hostite\u013ea na server pod kontrolou \u00fato\u010dn\u00edka. <\/p>\n

Pri uveden\u00ed URL vo forme \u00abhttps:\/\/evil.com?host=github.com\/\u00bb spracovate\u013e poveren\u00ed pri pripojen\u00ed k hostite\u013eovi evil.com prenesie autentifika\u010dn\u00e9 parametre zadan\u00e9 pre github.com. Probl\u00e9m sa prejavuje pri vykon\u00e1van\u00ed tak\u00fdch oper\u00e1ci\u00ed, ako je \u00abgit clone\u00bb, vr\u00e1tane spracovania URL pre submoduly (napr\u00edklad pri vykon\u00e1van\u00ed \u00abgit submodule update\u00bb sa automaticky spracuj\u00fa URL zadan\u00e9 v s\u00fabore .gitmodules z \u00falo\u017eiska). Najv\u00e4\u010d\u0161ie nebezpe\u010denstvo zranite\u013enos\u0165 predstavuje v situ\u00e1ci\u00e1ch, ke\u010f v\u00fdvoj\u00e1r klonuje \u00falo\u017eisko bez toho, aby videl URL, napr\u00edklad pri pr\u00e1ci so submodulmi, alebo v syst\u00e9moch vykon\u00e1vaj\u00facich automatick\u00e9 \u010dinnosti, napr\u00edklad v skriptoch na zostavovanie bal\u00edkov.<\/p>\n

Na zablokovanie zranite\u013enosti v nov\u00fdch verzi\u00e1ch je zak\u00e1zan\u00e9<\/a><\/noindex> sa mus\u00ed zablokova\u0165 odosielanie znaku nov\u00e9ho riadku v ak\u00fdchko\u013evek hodnot\u00e1ch, ktor\u00e9 s\u00fa pren\u00e1\u0161an\u00e9 cez protokol v\u00fdmeny pr\u00edstupov\u00fdch \u00fadajov. Pre distrib\u00facie je mo\u017en\u00e9 sledova\u0165 vydanie aktualiz\u00e1ci\u00ed bal\u00edkov na str\u00e1nkach Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>, FreeBSD<\/a><\/noindex>.<\/p>\n

Ako obch\u00e1dzaj\u00face rie\u0161enie na zablokovanie probl\u00e9mu odpor\u00fa\u010da sa<\/a><\/noindex> nepou\u017e\u00edva\u0165 credential.helper pri pr\u00edstupe na verejn\u00e9 \u00falo\u017eisk\u00e1 a nepou\u017e\u00edva\u0165 \u00abgit clone\u00bb v re\u017eime \u00ab--recurse-submodules\u00bb s neoveren\u00fdmi \u00falo\u017eiskami. Na \u00fapln\u00e9 vypnutie spracovate\u013ea credential.helper, ktor\u00fd vykon\u00e1va ulo\u017eenie<\/a><\/noindex> a na\u010d\u00edtanie hesiel z cache<\/a><\/noindex>, chr\u00e1nen\u00e9ho \u00falo\u017e\u00edsk<\/a><\/noindex> alebo s\u00faboru s heslami, mo\u017eno pou\u017ei\u0165 pr\u00edkazy:<\/p>\n

git config --unset credential.helper
\n git config --global --unset credential.helper
\n git config --system --unset credential.helper<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.1, 2.25.3, 2.24.2, 2.23.2, 2.22.3, 2.21.2, 2.20.3, 2.19.4, 2.18.3 \u0438 2.17.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-5260) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 «credential.helper«, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u043d\u0430 \u0442\u043e\u0442 \u0445\u043e\u0441\u0442 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 git-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044e \u043f\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 URL, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u043c\u0443 \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-77984","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Gite, ktor\u00e1 vedie k \u00faniku pr\u00edstupov\u00fdch \u00fadajov | ProHoster","description":"Boli vydan\u00e9 opravy distribu\u010dn\u00e9ho syst\u00e9mu spr\u00e1vy zdrojov\u00fdch k\u00f3dov Git 2.26.1, 2.25.3, 2.24.2, 2.23.2.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Git, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git 2.26.1, 2.25.3, 2.24.2, 2.23.2.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-git-privodyashhaya-k-utechke-uchyotnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-15T05:42:14+00:00","article:modified_time":"2020-04-15T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"77984","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:07:27","updated":"2022-10-02 19:46:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/77984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=77984"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/77984\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=77984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=77984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=77984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}