Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git client vulnerability announced

github.com

Post reply on HN
Print view View original

51–60 of 191 posts

Re: Git client vulnerability announced

#51

Post by ethomson »

avar wrote: post #33

Link to the patch that fixed it: https://github.com/git/git/commit/cc2fc7c

It's more than just that. There are a number of additional checks that are performed for the benefit of various insane filesystems like HFS and NTFS. For example: HFS has several codepoints that are ignored for the purposes of name comparison; for example, U+200C. We need to protect against those, too, or else you could have ".git/config" in your repository that maps to ".git/config".

Re: Git client vulnerability announced

#52

Post by taspeotis »

baldfat wrote: post #17

>In addition, the following updated versions of Git address this vulnerability: Not everyone has the patch. The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1). I have one Windows machine and went to update http://git-scm.com/download/win (preview Version 1.9.4) It was released 3 months ago, on 2014-09-29. https://msysgit.github.io (Versi…

One thing I want to know but haven't gotten around to figuring out who to ask is why msysgit is 1.x instead of 2.x? I saw some mention on their Github issue tracker that msysgit had been rebased on top of 2.x but the downloads don't seem to be updated.

I figured I could build from source if I really wanted and the downloads would be updated eventually but ... they have not.

Re: Git client vulnerability announced

#54

Post by dshankar »

mbrubeck wrote: post #44
dshankar wrote: post #32

Earlier quoted context omitted.

The blog post on Github.com only includes links to Github for Mac binaries, not git proper. The link in the blog post to kernel.org has tarballs of source, not binaries. Did I miss something?

It also includes a link to msysgit for Windows. If you need some type of binary not listed, it would help if you mention what type of binaries you need.

Fair point. I was looking for Mac binaries. Homebrew ending up being the quickest way to upgrade git, as much as I dislike using Homebrew :)

Re: Git client vulnerability announced

#55

Post by cheshire137 »

FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

I just downloaded git from git-scm.org and I only got 2.0.1. :/

Re: Git client vulnerability announced

#56

Post by akaBruce »

baldfat wrote: post #17

>In addition, the following updated versions of Git address this vulnerability: Not everyone has the patch. The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1). I have one Windows machine and went to update http://git-scm.com/download/win (preview Version 1.9.4) It was released 3 months ago, on 2014-09-29. https://msysgit.github.io (Versi…

For whatever it's worth, I just downloaded 1.9.5 for Windows from https://msysgit.github.io/. While the release notes don't mention "CVE-2014-9390" explicitly, it does say this:

Changes since Git-1.9.4-preview20140929

New Features ...

Bugfixes

* Safeguards against bogus file names on NTFS.

Edit: Actually, there it is on their git hub releases page. https://github.com/msysgit/msysgit/releases/tag/Git-1.9.5-pr...

Re: Git client vulnerability announced

#58

Post by [deleted] »

FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

[deleted]

Re: Git client vulnerability announced

#59

Post by fizzbatter »

tptacek wrote: post #9
FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

Lose the /or. Update no matter what.

Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os)

So, update no matter what, unless you're not on an affected system?

(this is a question, not a statement)

Re: Git client vulnerability announced

#60

Post by e40 »

FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

Cygwin and Macports both have versions which are vulnerable.

EDIT: Macports just updated. I did it with

# port selfupdate # port upgrade outdated

and 2.2.1 came down.

If you have the Apple git, then you should

# port install git

Post reply on HN