Isibuyekezo se-Git ngobunye ubungozi obulungisiwe

Ishicilelwe ukukhishwa okulungisayo kwesistimu yokulawula umthombo esabalalisiwe i-Git 2.26.2, 2.25.4, 2.24.3, 2.23.3, 2.22.4, 2.21.3, 2.20.4, 2.19.5, 2.18.4 kanye ne-2.17.5, ngaphakathi eyaqeda ukuba sengozini (I-CVE-2020-11008), isikhumbuzi inkinga, iqedwe ngesonto eledlule. Ukuba sengozini okusha kuphinda kuthinte izibambi ze-"credential.helper" futhi kuyasetshenziswa lapho kudluliswa i-URL efomethwe ngokukhethekile equkethe uhlamvu olusha, umsingathi ongenalutho, noma uhlelo lwesicelo olungashiwongo. Lapho icubungula i-URL enjalo, i-credential.helper ithumela ulwazi mayelana nemininingwane engafani nephrothokholi eceliwe noma umsingathi ofinyelelwayo.

Ngokungafani nenkinga yangaphambilini, uma usebenzisa ubungozi obusha, umhlaseli akakwazi ukulawula ngokuqondile umsingathi lapho kuzodluliswa khona izifakazelo zomunye umuntu. Yiziphi iziqinisekiso eziputshuziwe zincike ekutheni ipharamitha “yosokhaya” elahlekile isingathwa kanjani ku-credential.helper. Umnyombo wenkinga ukuthi izinkambu ezingenalutho ku-URL zitolikwa izibambi eziningi ze-credential.helper njengemiyalelo yokusebenzisa noma yiziphi izifakazelo esicelweni samanje. Ngakho, i-credential.helper ingathumela imininingwane egcinelwe enye iseva kuseva yomhlaseli ecaciswe ku-URL.

Inkinga yenzeka lapho kwenziwa imisebenzi efana ne-"git clone" kanye ne-"git fetch", kodwa iyingozi kakhulu lapho kucutshungulwa amamojula angaphansi - lapho kwenziwa "i-git submodule update", ama-URL acaciswe kufayela elithi .gitmodules asuka endaweni yokugcina acutshungulwa ngokuzenzakalelayo. Njengendlela yokulungisa inkinga kunconyiwe Ungasebenzisi i-credential.helper lapho ufinyelela amakhosombe omphakathi futhi ungasebenzisi i-"git clone" kumodi ye-"--recurse-submodules" enamakhosombe angahloliwe.

Inikezwe ekukhishweni okusha kwe-Git ukulungiswa ivimbela ukushayela i-credential.helper kuma-URL aqukethe amanani angameleleki (isibonelo, uma ucacisa izisilashi ezintathu esikhundleni sokubili - “http:///host” noma ngaphandle kohlelo lwephrothokholi - “http::ftp.example.com/”). Inkinga ithinta isitolo (isitoreji esakhelwe ngaphakathi se-Git), inqolobane (inqolobane eyakhelwe ngaphakathi yemininingwane efakiwe), kanye nezibambi ze-osxkeychain (isitoreji se-macOS). Isiphathi se-Git Credential (Windows repository) asithinteki.

Ungakwazi ukulandelela ukukhishwa kwezibuyekezo zephakheji ekusatshalalisweni emakhasini Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, ALT, I-FreeBSD.

Source: opennet.ru