{"id":105334,"date":"2022-10-19T15:37:13","date_gmt":"2022-10-19T13:37:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell"},"modified":"2022-10-19T15:37:13","modified_gmt":"2022-10-19T13:37:13","slug":"uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-git-proyavlyayushhiesya-pri-klonirovanii-submodulej-i-ispolzovanii-git-shell","title":{"rendered":"Vulnerabilitetet n\u00eb Git, q\u00eb shfaqen gjat\u00eb klonimit t\u00eb submoduleve dhe n\u00eb p\u00ebrdorimin e git shell","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Janeza e versioneve t\u00eb korrigjuara t\u00eb sistemit t\u00eb menaxhimit t\u00eb kodit burimor t\u00eb shp\u00ebrndar\u00eb Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 dhe 2.37.4, t\u00eb cilat adresojn\u00eb dy dob\u00ebsi q\u00eb shfaqen kur p\u00ebrdoret komanda «git clone» n\u00eb modalitetin «—recurse-submodules» me depo t\u00eb pa verifikuara dhe gjat\u00eb p\u00ebrdorimit t\u00eb modalitetit interaktiv «git shell». Mund t\u00eb ndiqni l\u00ebshimin e p\u00ebrdit\u00ebsimeve t\u00eb paketave n\u00eb shp\u00ebrndarjet si Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. <\/p>\n
\n
CVE-2022-39253 — dob\u00ebsia lejon nj\u00eb sulmuesi, i cili kontrollon p\u00ebrmbajtjen e depozitos q\u00eb po klonohet, t\u00eb ket\u00eb qasje n\u00eb t\u00eb dh\u00ebnat konfidenciale n\u00eb sistemin e p\u00ebrdoruesit, p\u00ebrmes vendosjes n\u00eb katalogun $GIT_DIR\/objects t\u00eb depozit\u00ebs q\u00eb po klonohet t\u00eb lidhjeve simbolike p\u00ebr skedar\u00ebt e interesit. Problemi shfaqet vet\u00ebm gjat\u00eb klonimit lokal (n\u00eb modalitetin «—local», i p\u00ebrdorur kur t\u00eb dh\u00ebnat e synuara dhe t\u00eb burimit ndodhen n\u00eb t\u00eb nj\u00ebjtin ndarje) ose gjat\u00eb klonimit t\u00eb nj\u00eb depoje t\u00eb keqe, e paketuar si nj\u00eb sub-modul n\u00eb nj\u00eb depo tjet\u00ebr (p\u00ebr shembull, gjat\u00eb p\u00ebrfshirjes rekurzive t\u00eb sub-modulave me komand\u00ebn «git clone —recurse-submodules»).\n
Dob\u00ebsia shkaktohet nga fakti se n\u00eb modalitetin e klonimit «—local», git transferon p\u00ebrmbajtjen e $GIT_DIR\/objects n\u00eb katalogun e synuar (krijon lidhje t\u00eb forta ose kopje skedar\u00ebsh), duke realizuar dereferencimin e lidhjeve simbolike (dmth, n\u00eb p\u00ebrfundim n\u00eb katalogun e synuar kopjohen jo lidhjet simbolike, por direkt skedar\u00ebt q\u00eb ato tregojn\u00eb). P\u00ebr t\u00eb bllokuar manifestimin e dob\u00ebsis\u00eb n\u00eb versionet e reja t\u00eb git, \u00ebsht\u00eb ndaluar klonimi i depozita n\u00eb modalitetin «—local», q\u00eb p\u00ebrmbajn\u00eb lidhje simbolike n\u00eb katalogun $GIT_DIR\/objects. P\u00ebr m\u00eb tep\u00ebr, vlera e parametrit protocol.file.allow \u00ebsht\u00eb ndryshuar n\u00eb «user», q\u00eb e klasifikon operacionet e klonimit q\u00eb p\u00ebrdorin protokollin file:\/\/ si t\u00eb pasigurta. <\/p>\n
CVE-2022-39260 \u2014 nj\u00eb mbivendosje e numrave n\u00eb funksionin split_cmdline(), i p\u00ebrdorur n\u00eb komand\u00ebn \u00abgit shell\u00bb. Problemi mund t\u00eb shfryt\u00ebzohet p\u00ebr t\u00eb sulmuar p\u00ebrdoruesit, t\u00eb cil\u00ebt p\u00ebrdorin \u00abgit shell\u00bb si shell p\u00ebr hyrje dhe kan\u00eb aktivizuar modin interaktiv (n\u00ebse \u00ebsht\u00eb krijuar nj\u00eb skedar $HOME\/git-shell-commands). Shfryt\u00ebzimi i k\u00ebsaj ndjeshm\u00ebrie mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm n\u00eb sistem kur d\u00ebrgohet nj\u00eb komand\u00eb e formatuar posa\u00e7\u00ebrisht, me nj\u00eb madh\u00ebsi m\u00eb t\u00eb madhe se 2 GB. <\/ul>\n