Git client vulnerability announced
81–90 of 191 posts
Re: Git client vulnerability announced
#82I am running OSX Yosemite.
➜ ~ git --version
git version 1.9.3 (Apple Git-50)
Re: Git client vulnerability announced
#83Should programs periodically check for critical security fixes, and then refuse to run if the current version is affected? It seems like there are a lot of people who don't really pay attention to social media or other security alert channels, who won't have a clue about the extent of this vulnerability. I'm sure they'd update if they knew "if I clone a malicious repo, I'm toast," but there's no way to inform them ex…
I'm not sure how I feel about programs phoning home like that. I tolerate it with apps, but command line tools ought to be doing their stated function when run.
There was a discussion of this a few weeks ago on the mailinglist of a scientific software project I use. The people were very clearly divided into the "Flash does it, so it's ok" and "omg no, think of the user privacy" camps, it was quite interesting.
Re: Git client vulnerability announced
#84Earlier quoted context omitted.
Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)
Or Linux mounting a case-insensitive share, e.g. CIFS.
[deleted]
Re: Git client vulnerability announced
#85I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…
It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.
Yes. This. I work in a fairly Enterprisey company that uses git as their VCS. I'm just hoping that IT is relatively calm about this and just pushes out updates/nags people about upgrading their git client.
Re: Git client vulnerability announced
#86Earlier quoted context omitted.
Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)
Or Linux mounting a case-insensitive share, e.g. CIFS.
[deleted]
Re: Git client vulnerability announced
#87Earlier quoted context omitted.
Lose the /or. Update no matter what.
Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)
OK, just so everyone is up to speed: Under what circumstances could a Linux filesystem be case-insensitive?
I know of three: FAT (specifically vfat, these days), JFS with Option -O, and CIOPFS (Case Insensitive On Purpose Filesystem):
http://superuser.com/questions/290480/case-insensitive-parti...
http://linux.die.net/man/8/mkfs.jfs
http://manpages.ubuntu.com/manpages/hardy/man8/jfs_mkfs.8.ht...
http://www.brain-dump.org/projects/ciopfs/
Are there any more?
Re: Git client vulnerability announced
#88Earlier quoted context omitted.
Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.
Gah. Incidents like this makes me frustrated OS X doesn’t have a solid package manager like APT.
Is package management really at issue here? For Apple supplied software, I think it really boils down to the same thing as other distros/OSes: timeliness of security updates. If Apple isn't able to spin out incremental security updates as quickly as other distributions, I'd say that process issue is the real problem.
Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew. Self-contained third party apps get a more managable space of base system profiles to target, and the installation UX can be as simple as drag/drop/app works. Us "special needs" users can then layer on and manage more esoteric and/or cutting-edge tools as needed with a full package manager. Heck, I was really glad to see Linuxbrew finally come to fruition for this very same reason. Have your cake and roll a newer-than-distro version of your tools too!
Re: Git client vulnerability announced
#89Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…
For those wondering about the analogous vulnerability in Mercurial, the patch notes are out for a fix:
http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_....
You'll need 3.2.3 to be secure.
Re: Git client vulnerability announced
#90If you don't want to use homebrew on mac, here is the list of commands I used to upgrade: https://gist.github.com/jazzychad/07c0c6da5709202e8106
Thanks - really appreciate the signature checking phase.
To make sure I had a working git in case all went wrong I added:
sudo mv /usr/bin/git /usr/bin/git2
before the symlink.