ProHoster > Blog > internet nhau > Git update ine 8 vulnerabilities yakagadziriswa

Git update ine 8 vulnerabilities yakagadziriswa

Rakabudiswa kugadzirisa kuburitswa kweiyo yakagoverwa sosi control system Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4 uye 2.14.62.24.1 . Matambudziko mazhinji anozivikanwa nevashandi
Microsoft Security Response Center, zvishanu pazvisere zvidziviriro zvine chekuita neWindows platform.

  • CVE-2019-1348 -kutepfenyura kuraira "chinhu chekutumira-mamaki = nzira"Kunoitawo nyora mavara kumadhairekitori asina musoro, ayo anogona kushandiswa kupenengura nzira mufaira refaira paunenge uchiita "git kukurumidza-import" mashandiro asina kutariswa ekuisa data.
  • CVE-2019-1350 - kupukunyuka kusiri iko kwenharo dzemutsara wekuraira aigona kutungamirira kuendesa kure kure kweanorwisa kodhi panguva yekudzokorora cloning uchishandisa ssh: // URL. Kunyanya, kupokana kupokana kunopera nekumashure (semuenzaniso, "test \") yakabatwa zvisirizvo. Muchiitiko ichi, pakugadzira gakava rine makotesheni akapetwa kaviri, chirevo chekupedzisira chakapukunyuka, izvo zvakaita kuti zvikwanisike kuronga kutsiviwa kwesarudzo dzako pamutsara wekuraira.
  • CVE-2019-1349 - kana uchidzokorora cloning submodules ("clone -recurse-submodules") munzvimbo yeWindows pasi pemamwe mamiriro. zvingadaro tanga kushandiswa kweiyo git dhairekitori kaviri (.git, git~1, git~2 uye git~N zvinozivikanwa sedhairekitori rimwe muNTFS, asi mamiriro ezvinhu aya akaedzwa chete git ~ 1), inogona kushandiswa kuronga. kunyora kudhairekitori ". git". Kuti aronge maitirwo ekodhi yake, munhu anorwisa, semuenzaniso, anogona kutsiva chinyorwa chake kuburikidza ne-post-checkout handler mu.git/config file.
  • CVE-2019-1351 - mubati wemazita edhiraivha muWindows nzira kana achiturikira nzira dzakaita senge "C:\" akagadzirirwa chete kutsiva ane-mavara echiLatin zviziviso, asi haana kufunga nezve mukana wekugadzira madhiraivha anopihwa kuburikidza ne "subst letter: path" . Nzira dzakadaro dzaibatwa kwete sedzakakwana, asi senzira dzehukama, izvo zvakaita kuti zvikwanisike, pakuumba nzvimbo ine utsinye, kuronga rekodhi mune imwe dhairekitori kunze kwekushanda dhairekitori remuti (semuenzaniso, kana uchishandisa nhamba kana unicode mavara mudhisiki. zita - "1:\what\the\ hex.txt" kana "Γ€:\tschibΓ€t.sch").
  • CVE-2019-1352 - kana uchishanda paWindows platform, kushandiswa kweimwe nzira yedata data muNTFS, yakagadzirwa nekuwedzera iyo ": rwizi-zita: rukova-mhando" hunhu kune zita refaira, kubvumidzwa bvisa mafaera mu ".git/" dhairekitori paunenge uchigadzira inokuvadza repository. Semuyenzaniso, zita rekuti ".git::$INDEX_ALLOCATION" muNTFS rakatorwa serinongedzo rinoshanda kune ".git" dhairekitori.
  • CVE-2019-1353 - kana uchishandisa Git muWSL (Windows Subsystem yeLinux) nharaunda kana uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchingedzera dhairekitori isina kushandiswa dziviriro kubva mukunyengedzwa kwezita muNTFS (kurwiswa kuburikidza nekushandura zita reFAT kwaikwanisika, semuenzaniso, ".git" yaigona kuwanikwa kuburikidza ne "git~1" dhairekitori).
  • CVE-2019-1354 -
    mukana inonyora ku ".git/" dhairekitori paWindows papuratifomu paunenge uchigadzira matura akashata ane mafaera ane backslash muzita (semuenzaniso, "a\b"), inogamuchirwa paUnix/Linux, asi inogamuchirwa sechikamu che nzira iri paWindows.

  • CVE-2019-1387 - kusakwana kwekutarisa mazita e submodule inogona kushandiswa kuronga kurwiswa kwakanangwa, uko, kana kwakadzokororwa, kunogona aigona kutungamirira kuita kodhi yeanorwisa. Git haina kudzivirira kugadzirwa kwe submodule dhairekitori mukati meimwe submodule dhairekitori, iyo kazhinji kazhinji yaingotungamira mukuvhiringika, asi haina kukwanisa kudzivirira zviri mukati meimwe module kuti zvinyorwe panguva yekudzokororwa cloning process (semuenzaniso, submodule madhairekitori. "mvuu" uye "mvuu/zviredzo" zvinoiswa se " .git/modules/mvuu/" uye ".git/modules/mvuu/zviredzo/", uye dhairekitori rezvikorekedzo mumvuu rinogona kushandiswa zvakasiyana kugashira hoko dzakatanga.

Vashandisi veWindows vanorayirwa kuti vagadzirise vhezheni yavo yeGit nekukasira, uye kuti varambe kuumba marepositori asina kusimbiswa kusvika pakuvandudzwa. Kana zvisati zvave kukwanisa kukurumidza kugadzirisa iyo Git vhezheni, zvino kuderedza njodzi yekurwiswa, zvinokurudzirwa kuti usamhanye "git clone -recurse-submodules" uye "git submodule update" ine isina kuchekwa repositori, kwete kushandisa "git". kukurumidza-import” ine hova dzekupinda dzisina kuchekwa, uye kwete kutevedzera marepositori kune NTFS-based partitions.

Kuti uwedzere kuchengetedzwa, zvitsva zvakaburitswa zvinorambidzawo kushandiswa kwezvivakwa zvefomu "submodule.{name}.update=!command" mu.gitmodules. Nekugovera, unogona kuteedzera kuburitswa kwepakeji zvigadziriso pamapeji Debian,Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, ALT, FreeBSD.

Source: opennet.ru

Voeg