Git inogadziridza neimwe njodzi yakagadziriswa

Rakabudiswa kugadzirisa kuburitswa kweiyo yakagoverwa sosi control system Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 uye 2.17.5, mukati izvo zvakabviswa vulnerability (CVE-2020-11008), chiyeuchidzo dambudziko, yakabviswa svondo rapfuura. Kusagadzikana kutsva kunobatawo vanobata "credential.helper" uye kunoshandiswa pakupfuura URL yakanyatsorongwa ine mavara matsva, munhu asina chinhu, kana chirongwa chekukumbira chisina kutaurwa. Paunenge uchigadzira URL yakadai, credential.helper inotumira ruzivo nezvezvitupa zvisingaenderane neprotocol yakakumbirwa kana mugamuchiri ari kuwanikwa.

Kusiyana nedambudziko rekare, kana uchishandisa kusazvibata kutsva, anorwisa haakwanise kudzora zvakananga mugamuchiri kubva kunozotamiswa zvitupa zvemumwe munhu. Ndeupi humbowo hunoburitswa zvinoenderana nekuti iyo yakashaikwa "host" parameter inobatwa sei mu credential.helper. Mhedzisiro yedambudziko ndeyekuti minda isina chinhu muURL inodudzirwa nevazhinji credential.helper handlers semirayiridzo yekushandisa chero zvitupa kune chikumbiro chazvino. Saka, credential.helper inogona kutumira zvinyorwa zvakachengeterwa imwe sevha kune server yeanorwisa inotsanangurwa muURL.

Dambudziko rinoitika pakuita maoparesheni akadai se "git clone" uye "git fetch", asi rine njodzi zvakanyanya pakugadziridza submodules - pakuita "git submodule update", maURL akatsanangurwa mu.gitmodules faira kubva mudura anogadziriswa otomatiki. Sechigadziriso chekuvhara dambudziko yakakurudzirwa Usashandise credential.helper paunenge uchiwana nzvimbo dzeruzhinji uye usashandise "git clone" mu "--recurse-submodules" modhi ine marepositori asina kuvharwa.

Inopihwa mune itsva Git kuburitswa kururamisa inodzivirira kufona credential.helper yemaURL ane tsika dzisingamiriri (semuenzaniso, kana uchitsanangura zvidimbu zvitatu pane maviri - "http:///host" kana pasina chirongwa cheprotocol - "http::ftp.example.com/"). Iyo nyaya inobata chitoro (yakavakirwa-muGit credential chengetedzo), cache (yakavakirwa-mukati cache yezvakapinda zvitupa), uye osxkeychain (macOS kuchengetedza) vanobata. Iyo Git Credential Manager (Windows repository) inobata haina kukanganiswa.

Iwe unogona kuteedzera kuburitswa kwepakeji zvigadziriso mukugovera pamapeji Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, ALT, FreeBSD.

Source: opennet.ru