Jan\u00eb publikuar versionet korrigjuese t\u00eb sistemit t\u00eb shp\u00ebrndarjes s\u00eb menaxhimit t\u00eb tekstual me burim Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 dhe 2.37.4, n\u00eb t\u00eb cilat jan\u00eb eliminuar dy vulnerabilitete q\u00eb shfaqen kur p\u00ebrdoret komanda «git clone» n\u00eb modin «—recurse-submodules» me depo t\u00eb pa verifikuara dhe kur p\u00ebrdoret modaliteti interaktiv i pun\u00ebs «git shell». Mund t\u00eb ndiqni l\u00ebshimet e azhurnimeve t\u00eb paketave n\u00eb distribucionet Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. <\/p>\n
\n
CVE-2022-39253 — vulnerabiliteti lejon nj\u00eb sulmues, i cili kontrollon p\u00ebrmbajtjen e depozit\u00ebs s\u00eb klonuar, t\u00eb fitoj\u00eb qasje n\u00eb t\u00eb dh\u00ebna t\u00eb ndjeshme n\u00eb sistemin e p\u00ebrdoruesit, p\u00ebrmes vendosjes s\u00eb lidhjeve simbolike p\u00ebr skedar\u00ebt e interesuar n\u00eb katalogun $GIT_DIR\/objects t\u00eb depozit\u00ebs s\u00eb klonuar. Problemi shfaqet vet\u00ebm gjat\u00eb klonimit lokal (n\u00eb modin «—local», i p\u00ebrdorur kur t\u00eb dh\u00ebnat target dhe burimi i klonimit ndodhen n\u00eb t\u00eb nj\u00ebjtin seksion) ose gjat\u00eb klonimit t\u00eb nj\u00eb depoje t\u00eb d\u00ebmshme, e cila \u00ebsht\u00eb paketuar n\u00eb form\u00ebn e nj\u00eb submoduli n\u00eb nj\u00eb depo tjet\u00ebr (p\u00ebr shembull, gjat\u00eb p\u00ebrfshirjes rekurzive t\u00eb submodulave me komand\u00ebn «git clone —recurse-submodules»).\n
Vulnerabiliteti shkaktohet nga fakti se n\u00eb modin e klonimit «—local», git transferon p\u00ebrmbajtjen e $GIT_DIR\/objects n\u00eb katalogun target (krijon lidhje t\u00eb forta ose kopje t\u00eb skedar\u00ebve), duke kryer de-referencimin e lidhjeve simbolike (dmth, n\u00eb p\u00ebrfundim, n\u00eb katalogun target kopjohen jo lidhjet simbolike, por drejtp\u00ebrdrejt skedar\u00ebt q\u00eb tregojn\u00eb lidhjet). P\u00ebr t\u00eb bllokuar shfaqjen e vulnerabilitetit n\u00eb versionet e reja t\u00eb git, \u00ebsht\u00eb ndaluar klonimi i depozita n\u00eb modin «—local», q\u00eb p\u00ebrmbajn\u00eb lidhje simbolike n\u00eb katalogun $GIT_DIR\/objects. P\u00ebrve\u00e7 k\u00ebsaj, vlera me t\u00eb cil\u00ebn parameteri protocol.file.allow \u00ebsht\u00eb ndryshuar n\u00eb «user», duke e kategorizuar operacionet e klonimit me protokollin file:\/\/ si t\u00eb pasigurta. <\/p>\n
CVE-2022-39260 — overflow i numrave t\u00eb plot\u00eb n\u00eb funksionin split_cmdline(), i p\u00ebrdorur n\u00eb komand\u00ebn «git shell». Problemi mund t\u00eb p\u00ebrdoret p\u00ebr sulme ndaj p\u00ebrdoruesve, t\u00eb cil\u00ebt p\u00ebrdorin «git shell» si shell kur hyjn\u00eb dhe kemi aktivizuar modalitetin interaktiv t\u00eb pun\u00ebs (n\u00eb krijimin e skedarit $HOME\/git-shell-commands). Shfryt\u00ebzimi i vulnerabilitetit mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm n\u00eb sistem, gjat\u00eb d\u00ebrgimit t\u00eb nj\u00eb komande t\u00eb formatizuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb, me nj\u00eb madh\u00ebsi m\u00eb t\u00eb madhe se 2 GB. <\/ul>\n