Git fa'afouga ma 8 fa'aletonu ua fa'amauina

Lolomiina faʻasaʻoga faʻasaʻo o le faʻasalalauga faʻapipiʻi faʻatonuga Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4 ma 2.14.62.24.1 XNUMX, lea na fa'amauina ai fa'aletonu e mafai ai e le tagata osofa'i ona toe tusia ala fa'aletonu i totonu o le faila faila, fa'atulaga le fa'atinoina o le code mamao, po'o le fa'asolo atu o faila i le ".git/" directory. Ole tele o fa'afitauli e iloa e tagata faigaluega
Microsoft Security Response Center, e lima o le valu faʻafitauli e faʻapitoa i le Windows platform.

  • CVE-2019-1348 - faʻatonuina le faʻatonuga "faʻailoga faʻailoga-faʻailoga = ala"e mafai ai tusi fa'ailoga i fa'atonuga fa'atonu, lea e mafai ona fa'aoga e fa'asolo ai ala fa'atonu i totonu o le faila faila pe a fa'atino se fa'agaioiga "git fast-import" fa'atasi ai ma fa'amaumauga e le'i siakiina.
  • CVE-2019-1350 - sola sa'o ole fa'aupuga o laina fa'atonu mafai ona taitai i le faʻatinoina mamao o le code attacker i le taimi o le faʻaogaina o le faʻaogaina o le ssh:// URL. Aemaise lava, o le sola ese o finauga e faai'u i le pito i tua (fa'ata'ita'iga, "su'ega \") na sese le taulimaina. I lenei tulaga, pe a fai se finauga ma upusii faalua, o le upusii mulimuli na sao, lea na mafai ai ona faʻatulagaina le sui o au filifiliga i luga o le laina o le poloaiga.
  • CVE-2019-1349 — pe a toe fa'a-clone submodules (“clone —recurse-submodules”) i le siosiomaga o Pupuni i lalo o nisi tulaga. e mafai faʻaosoina le faʻaogaina o le git directory faʻalua (.git, git ~ 1, git ~ 2 ma git ~ N o loʻo amanaʻia o se tasi tusi i le NTFS, ae o lenei tulaga na faʻataʻitaʻiina mo git ~ 1), lea e mafai ona faʻaaoga e faʻatulaga tusi i le lisi ". git". Ina ia faʻatulagaina le faʻataunuʻuina o lana code, o se tagata osofaʻi, mo se faʻataʻitaʻiga, e mafai ona suitulaga i lana tusitusiga e ala i le post-checkout handler i le faila .git/config.
  • CVE-2019-1351 - o le faʻatonu mo igoa taʻavale mataʻitusi i auala Windows pe a faʻaliliu auala e pei o le "C: \" na fuafuaina e suitulaga tasi-mataitusi faʻamatalaga Latina, ae na te leʻi manatu i le avanoa e fatuina ai masini faʻapitoa na tuʻuina atu e ala i le "subst letter:path" . O ia auala e le o faʻamaoni, ae o ni auala vavalalata, lea na mafai ai, pe a faʻapipiʻi se fale teu oloa leaga, e faʻapipiʻi se faʻamaumauga i totonu o se lisi faʻapitoa i fafo atu o le laʻau tusi galue (mo se faʻataʻitaʻiga, pe a faʻaaoga numera poʻo mataitusi unicode i le disk igoa - “1:\what\the\ hex.txt" po'o le "ä:\tschibät.sch").
  • CVE-2019-1352 - pe a galue i luga o le Windows platform, o le faʻaogaina o isi faʻamatalaga faʻamatalaga i le NTFS, faia e ala i le faʻaopoopoina o le ": stream-name: stream-type" uiga i le igoa faila, faatagaina fa'asolo faila i totonu o le ".git/" directory pe a fa'aputuina se fale teu oloa leaga. Mo se fa'ata'ita'iga, o le igoa ".git::$INDEX_ALLOCATION" i le NTFS sa fa'atatauina ose so'otaga fa'atatau ile ".git" directory.
  • CVE-2019-1353 - pe a faʻaogaina le Git i se WSL (Windows Subsystem mo Linux) siosiomaga pe a faʻaogaina le lisi o galuega le faaaogaina puipuiga mai le fa'aogaina o igoa ile NTFS (o osofa'iga e ala i le fa'aliliuga o igoa FAT na mafai, mo se fa'ata'ita'iga, ".git" e mafai ona maua i le "git~1" directory).
  • CVE-2019-1354 -
    avanoa tusi i le ".git/" directory i luga o le Windows platform pe a cloning leaga faleteuoloa o loʻo i ai faila ma se backslash i le igoa (mo se faʻataʻitaʻiga, "a\b"), lea e talia i Unix/Linux, ae ua taliaina o se vaega o le ala ile Windows.

  • CVE-2019-1387 - le lava le siakiina o igoa o submodule e mafai ona faʻaogaina e faʻatulaga ai osofaʻiga faʻatatau, lea, afai e toe faʻapipiʻiina, e ono mafai mafai ona taitai e fa'atino le code a le tagata osofa'i. E le'i taofia e Git le fausiaina o se submodule directory i totonu o le isi submodule's directory, lea i le tele o tulaga e na'o le fenumiai, ae le mafai ona taofia ai mea o loʻo i totonu o se isi module mai le faʻauluina i le faagasologa o le faʻaogaina o le faʻasologa (mo se faʻataʻitaʻiga, le submodule directories. O le "hippo" ma le "hippo/hooks" o lo'o tu'uina e pei o le ".git/modules/hippo/" ma le ".git/modules/hippo/hooks/", ma o le lisi o matau i hippo e mafai ona fa'aoga eseese e fa'afeiloa'i ai matau fa'aoso.

Ua fautuaina tagata fa'aoga Windows ina ia vave fa'afou a latou lomiga o Git, ma ia aloese mai le fa'aputuina o fale teu fa'amaonia se'ia o'o i le fa'afouga. Afai e le o mafai ona vave faʻafouina le Git version, ona faʻaitiitia ai lea o le lamatiaga o le osofaʻiga, e fautuaina e aua le taʻavale "git clone -recurse-submodules" ma le "git submodule update" faʻatasi ai ma faleoloa e leʻi siakiina, aua le faʻaogaina le "git. vave-faʻaulufale mai" faʻatasi ai ma vaitafe faʻapipiʻi e leʻi siakiina, ae le o le faʻapipiʻiina o fale teu i vaega faʻavae NTFS.

Mo le fa'aopoopoina o le puipuiga, o fa'asalalauga fou fo'i e fa'asa ai le fa'aogaina o faufale o le fomu "submodule.{name}.update=!command" i .gitmodules. Mo tufatufaga, e mafai ona e siaki le tatalaina o faʻafouga o afifi i luga o itulau Debian,Ubuntu, RHEL, SUSE/openSUSE, Fedora, faitotoa faaofuofu, ALT, FreeBSD.

puna: opennet.ru

Faaopoopo i ai se faamatalaga