ื’ื™ื˜ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ืžื™ื˜ ืืŸ ืื ื“ืขืจ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืคืึทืจืคืขืกื˜ื™ืงื˜

ืคึฟืึทืจืขืคึฟื ื˜ืœืขื›ื˜ ืงืขืจืขืงื˜ื™ื•ื• ืจื™ืœื™ืกื™ื– ืคื•ืŸ ื“ื™ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžืงื•ืจ ืงืึธื ื˜ืจืึธืœ ืกื™ืกื˜ืขื ื’ื™ื˜ 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 ืื•ืŸ 2.17.5, ืื™ืŸ ื•ื•ืึธืก ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2020-11008), ื“ืขืจืžืื ื˜ ื“ื™ ืคึผืจืึธื‘ืœืขื, ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ ืœืขืฆื˜ืข ื•ื•ืึธืš. ื“ื™ ื ื™ื™ึทืข ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื•ื™ืš ืึทืคืขืงืฅ "credential.helper" ื”ืึทื ื“ืœืขืจืก ืื•ืŸ ืื™ื– ืขืงืกืคึผืœื•ื™ื˜ืึทื“ ื•ื•ืขืŸ ืคืึธืจืŸ ืึท ืกืคึผืขืฆื™ืขืœ ืคืึธืจืžืึทื˜ื˜ืขื“ URL ืžื™ื˜ ืึท ื ื™ื™ึท-ืœื™ื ืข ื›ืึทืจืึทืงื˜ืขืจ, ืึท ืœื™ื™ื“ื™ืง ื‘ืึทืœืขื‘ืึธืก ืึธื“ืขืจ ืึทืŸ ื•ื ืกืคึผืขืกื™ืคื™ืขื“ ื‘ืขื˜ืŸ ืกื›ืขืžืข. ื•ื•ืขืŸ ืคึผืจืึทืกืขืกื™ื ื’ ืึทื–ืึท ืึท URL, credential.helper ืกืขื ื“ื– ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ืงืจืึทื“ืขื ื˜ืฉืึทืœื– ื•ื•ืึธืก ื˜ืึธืŸ ื ื™ื˜ ืฉื˜ื™ืžืขืŸ ืžื™ื˜ ื“ื™ ื’ืขื‘ืขื˜ืŸ ืคึผืจืึธื˜ืึธืงืึธืœ ืึธื“ืขืจ ื“ืขืจ ื‘ืึทืœืขื‘ืึธืก ื•ื•ืึธืก ืื™ื– ืึทืงืกืขืกื˜.

ื ื™ื˜ ืขื ืœืขืš ื“ืขื ืคืจื™ืขืจื“ื™ืงืŸ ืคึผืจืึธื‘ืœืขื, ื•ื•ืขืŸ ื ื™ืฆืŸ ืึท ื ื™ื™ึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™, ื“ืขืจ ืึทื˜ืึทืงืขืจ ืงืขืŸ ื ื™ืฉื˜ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ื‘ืึทืœืขื‘ืึธืก ืคื•ืŸ ื•ื•ืึธืก ืขืžืขืฆืขืจ ืึทื ื“ืขืจืฉ ืก ืงืจืึทื“ืขื ื˜ืฉืึทืœื– ื•ื•ืขื˜ ื–ื™ื™ืŸ ื˜ืจืึทื ืกืคืขืจื“. ื•ื•ืึธืก ืงืจืึทื“ืขื ื˜ืฉืึทืœื– ื–ืขื ืขืŸ ืœื™ืงื˜ ื“ืขืคึผืขื ื“ืก ืื•ื™ืฃ ื•ื•ื™ ื“ื™ ืคืขืœื ื“ื™ืง "ื‘ืึทืœืขื‘ืึธืก" ืคึผืึทืจืึทืžืขื˜ืขืจ ืื™ื– ื›ืึทื ื“ืึทืœื“ ืื™ืŸ credential.helper. ื“ื™ ื”ืึทืจืฅ ืคื•ืŸ ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืึทื– ืœื™ื™ื“ื™ืง ืคืขืœื“ืขืจ ืื™ืŸ ื“ื™ URL ื–ืขื ืขืŸ ื™ื ื˜ืขืจืคึผืจืึทื˜ืึทื“ ื“ื•ืจืš ืคื™ืœืข credential.helper ื”ืึทื ื“ืœืขืจืก ื•ื•ื™ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืฆื• ืฆื•ืœื™ื™ื’ืŸ ืงื™ื™ืŸ ืงืจืึทื“ืขื ื˜ืฉืึทืœื– ืฆื• ื“ื™ ืงืจืึทื ื˜ ื‘ืขื˜ืŸ. ืึทื–ื•ื™, credential.helper ืงืขื ืขืŸ ืฉื™ืงืŸ ืงืจืึทื“ืขื ื˜ืฉืึทืœื– ืกื˜ืึธืจื“ ืคึฟืึทืจ ืืŸ ืื ื“ืขืจ ืกืขืจื•ื•ืขืจ ืฆื• ื“ื™ ืึทื˜ืึทืงืขืจ ืก ืกืขืจื•ื•ืขืจ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ URL.

ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืึทืงืขืจื– ื•ื•ืขืŸ ืคึผืขืจืคืึธืจืžื™ื ื’ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืึทื–ืึท ื•ื•ื™ "ื’ื™ื˜ ืงืœืึธื•ืŸ" ืื•ืŸ "ื’ื™ื˜ ื‘ืจืขื ื’ืขืŸ", ืึธื‘ืขืจ ืื™ื– ืžืขืจืกื˜ ื’ืขืคืขืจืœืขืš ื•ื•ืขืŸ ืคึผืจืึทืกืขืกื™ื ื’ ืกื•ื‘ืžืึธื“ื•ืœืขืก - ื•ื•ืขืŸ ืคึผืขืจืคืึธืจืžื™ื ื’ "ื’ื™ื˜ ืกื•ื‘ืžืึธื“ื•ืœืข ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ", ื“ื™ URL ืก ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ .ื’ื™ื˜ืžืึธื“ื•ืœืขืก ื˜ืขืงืข ืคื•ืŸ โ€‹โ€‹ื“ื™ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ ื–ืขื ืขืŸ ืื•ื™ื˜ืึธืžืึทื˜ื™ืฉ ืคึผืจืึทืกืขืกื˜. ื•ื•ื™ ืึท ื•ื•ืึธืจืงืึทืจืึธื•ื ื“ ืฆื• ืคืึทืจืฉืคึผืึทืจืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื ืจืขืงืึทืžืขื ื“ื™ื“ ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ื ื•ืฆืŸ credential.helper ื•ื•ืขืŸ ืึทืงืกืขืก ืฆื• ืฆื™ื‘ื•ืจ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ื– ืื•ืŸ ื˜ืึธืŸ ื ื™ื˜ ื ื•ืฆืŸ "ื’ื™ื˜ ืงืœืึธื•ืŸ" ืื™ืŸ "--ืจืขืงื•ืจืกืข-ืกื•ื‘ืžืึธื“ื•ืœืขืก" ืžืึธื“ืข ืžื™ื˜ ื•ื ื˜ืฉืขืงืงืขื“ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ื–.

ื’ืขืคึฟื™ื ื˜ ืื™ืŸ ื ื™ื™ึทืข Git ืจื™ืœื™ืกื™ื– ืงืขืจืขืงืฉืึทืŸ ืคึผืจื™ื•ื•ืขื ืฅ ืจื•ืคืŸ credential.helper ืคึฟืึทืจ URL ืก ืžื™ื˜ ื•ื ืจืขืคึผืจืขืกืขื ื˜ืึทื‘ืœืข ื•ื•ืึทืœื•ืขืก (ืœืžืฉืœ, ื•ื•ืขืŸ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ืจื™ื™ ืกืœืึทืฉื™ื– ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ ืฆื•ื•ื™ื™ - "ื”ื˜ื˜ืคึผ:///ื”ืึธืกื˜" ืึธื“ืขืจ ืึธืŸ ืึท ืคึผืจืึธื˜ืึธืงืึธืœ ืกื›ืขืžืข - "http::ftp.example.com/"). ื“ื™ ืึทืจื•ื™ืกื’ืขื‘ืŸ ืึทืคืขืงืฅ ื“ื™ ืงืจืึธื (ื’ืขื‘ื•ื™ื˜-ืื™ืŸ Git ืงืจืึทื“ืขื ื˜ืฉืึทืœ ืกื˜ืึธืจื™ื“ื–ืฉ), ืงืึทืฉ (ื’ืขื‘ื•ื™ื˜ ืงืึทืฉ ืคื•ืŸ ืืจื™ื™ืŸ ืงืจืึทื“ืขื ื˜ืฉืึทืœื–) ืื•ืŸ osxkeychain (macOS ืกื˜ืึธืจื™ื“ื–ืฉ) ื”ืึทื ื“ืœืขืจืก. ื“ื™ Git Credential Manager (Windows ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™) ื”ืึทื ื“ืœืขืจ ืื™ื– ื ื™ืฉื˜ ืึทืคืขืงื˜ืึทื“.

ืื™ืจ ืงืขื ืขืŸ ืฉืคึผื•ืจ ื“ื™ ืžืขืœื“ื•ื ื’ ืคื•ืŸ ืคึผืขืงืœ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืื™ืŸ ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื– ืื•ื™ืฃ ื“ื™ ื‘ืœืขื˜ืขืจ ื“ืขื‘ื™ืึทืŸ, ื•ื‘ื•ื ื˜ื•, rhel, SUSE/openSUSE, ืคืขื“ืึธืจืึท, ืึทืจื˜ืฉ, ืึทืœื˜, FreeBSD.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’