Isibuyekezo se-Git esinokukhubazeka okungu-8 okulungisiwe

Ishicilelwe ukukhishwa okulungisayo kwesistimu yokulawula umthombo esabalalisiwe i-Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4 kanye ne-2.14.62.24.1 . Izinkinga eziningi ezikhonjwa ngabasebenzi
I-Microsoft Security Response Center, ubungozi obuhlanu kwayisishiyagalombili buqondene nengxenyekazi yeWindows.

  • I-CVE-2019-1348 — umyalo wokusakaza “isici sokuthekelisa-marks=indlela”kuvumela bhala amalebula ezinhlwini zemibhalo ezingafanele, ezingasetshenziswa ukubhala phezu kwezindlela ezingafanele ohlelweni lwefayela lapho kwenziwa umsebenzi othi "git-import fast" ngedatha yokufaka engahloliwe.
  • I-CVE-2019-1350 - ukuphunyuka okungalungile kwezimpikiswano zomugqa womyalo angahola ekwenzeni ukude kwekhodi yomhlaseli phakathi ne-cloning ephindaphindayo kusetshenziswa i-ssh:// URL. Ikakhulukazi, ukuphunyuka kwezimpikiswano ezigcina ngokuhlehla (isibonelo, “test \”) kusingathwe ngokungalungile. Kulesi simo, lapho usungula ingxabano ngezingcaphuno ezikabili, isicaphuni sokugcina siye saphunyuka, okwenza kwaba nokwenzeka ukuhlela ukushintshwa kwezinketho zakho emugqeni womyalo.
  • I-CVE-2019-1349 - lapho uhlanganisa ngokuphindaphindiwe ama-submodules ("clone -recurse-submodules") endaweni ye-Windows ngaphansi kwezimo ezithile kungaba njalo qalisa ukusetshenziswa kohla lwemibhalo lwe-git olufanayo kabili (.git, git~1, git~2 kanye ne-git~N zibonwa njengohlu lwemibhalo olulodwa ku-NTFS, kodwa lesi simo sihlolelwe i-git~1 kuphela), engasetshenziswa ukuhlela ubhalela uhla lwemibhalo ". git". Ukuze uhlele ukusetshenziswa kwekhodi yakhe, umhlaseli, isibonelo, angashintsha iskripthi sakhe ngesibambi sangemuva kokuphuma kufayela elithi .git/config.
  • I-CVE-2019-1351 — isibambi samagama edrayivu yezinhlamvu ezindleleni zeWindows lapho kuhunyushwa izindlela ezinjengokuthi “C:\” sasiklanyelwe kuphela ukuvala indawo yezihlonzi zesiLatini ezinohlamvu olulodwa, kodwa ayizange icabangele ithuba lokudala amadrayivu abonakalayo anikezwe “ngohlamvu oluncane:umzila” . Izindlela ezinjalo azizange ziphathwe njengeziphelele, kodwa njengezindlela ezihambisanayo, okwenze ukuthi, lapho kwenziwa inqolobane enonya, ukuhlela irekhodi kuhlu lwemibhalo olungenasizathu ngaphandle kwesihlahla somkhombandlela osebenzayo (isibonelo, lapho usebenzisa izinombolo noma izinhlamvu ze-unicode kudiski. igama - “1:\what\the\ hex.txt" noma "ä:\tschibät.sch").
  • I-CVE-2019-1352 - lapho usebenza endaweni yesikhulumi se-Windows, ukusetshenziswa kweminye imithombo yedatha ku-NTFS, edalwe ngokwengeza isibaluli esithi ":stream-name:stream-type" egameni lefayela, kuvunyelwe bhala ngaphezulu amafayela kuhla lwemibhalo ".git/" lapho uhlanganisa inqolobane eyingozi. Isibonelo, igama elithi ".git::$INDEX_ALLOCATION" ku-NTFS lithathwe njengesixhumanisi esivumelekile kumkhombandlela othi ".git".
  • I-CVE-2019-1353 - lapho usebenzisa i-Git endaweni ye-WSL (Windows Subsystem ye-Linux) lapho ufinyelela kumkhombandlela osebenzayo engasetshenzisiwe isivikelo ekukhohlisweni kwegama ku-NTFS (ukuhlaselwa ngokuhumusha igama le-FAT bekungenzeka, isibonelo, ".git" ingafinyelelwa ngohla lwemibhalo lwe-"git~1").
  • I-CVE-2019-1354 -
    ithuba ubhalela uhla lwemibhalo oluthi ".git/" kuplathifomu ye-Windows lapho uhlanganisa amakhosombe anonya aqukethe amafayela ane-backslash egameni (isibonelo, "a\b"), okwamukelekayo ku-Unix/Linux, kodwa okwamukelwe njengengxenye indlela ku-Windows.

  • I-CVE-2019-1387 - ukuhlolwa okunganele kwamagama emojula encane kungasetshenziswa ukuhlela ukuhlasela okuqondiwe, okuthi, uma kuphindaphindeka, kungahle kwenzeke. angahola ukwenza ikhodi yomhlaseli. I-Git ayizange ivimbele ukwakhiwa kohla lwemibhalo yemojuli encanyana ngaphakathi kohla lwemibhalo lwemojuli encanyana, okuvame ukuholela ekudidekeni, kodwa ayizange ikwazi ukuvimbela okuqukethwe kwenye imojuli ekubhalweni phezu kwayo phakathi nenqubo yokuphindaphinda yamamojula (isibonelo, uhla lwemibhalo lwamamojula angaphansi). "imvubu" kanye "nemvubu/izingwegwe" abekwe ngokuthi " .git/modules/hippo/" kanye ".git/modules/hippo/hook/", futhi uhla lwemibhalo lwezingwegwe kwimvubu lungasetshenziswa ngokuhlukana ukuze usonge amahhuku acushiwe.

Abasebenzisi be-Windows bayelulekwa ukuthi babuyekeze ngokushesha inguqulo yabo ye-Git, futhi bagweme ukuhlanganisa amakhosombe angaqinisekisiwe kuze kube isibuyekezo. Uma kungakenzeki okwamanje ukuvuselela inguqulo ye-Git ngokushesha, khona-ke ukunciphisa ingozi yokuhlaselwa, kutuswa ukuthi ungasebenzisi i-“git clone —recurse-submodules” kanye “nesibuyekezo se-git submodule” ngamakhosombe angahloliwe, hhayi ukusebenzisa i-“git. ukungenisa ngokushesha” ngokusakaza kokufakwayo okungahloliwe, futhi hhayi ukuhlanganisa amakhosombe kuma-partitions asekelwe ku-NTFS.

Ukuze uthole ukuvikeleka okwengeziwe, ukukhishwa okusha futhi kuvimbela ukusetshenziswa kwezakhiwo zefomu elithi "submodule.{name}.update=!command" ku-.gitmodules. Ngokusatshalaliswa, ungakwazi ukulandelela ukukhishwa kwezibuyekezo zephakheji emakhasini Debian,Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, ALT, I-FreeBSD.

Source: opennet.ru

Engeza amazwana