Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Server and Client RCE in Git version 2.7.1 and below

seclists.org

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Server and Client RCE in Git version 2.7.1 and below

#11

Post by sytse »

Mojah wrote: post #6

A couple of thoughts on the potential impact: https://ma.ttias.be/remote-code-execution-git-versions-clien... Server-side: github & bitbucket will get patched quickly, if they're even still vulnerable. Self-hosted installations like Gitlab will be more difficult, as it requires sysadmins to patch themselves. History has thought us this takes too long. Client-side: possibly the biggest impact, as nearly every Linux di…

At GitLab this was fixed with https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3240 which we plan to release tomorrow in 8.5.7 https://gitlab.com/gitlab-org/gitlab-ce/issues/14308

Re: Server and Client RCE in Git version 2.7.1 and below

#13

Post by 0x0 »

voltagex_ wrote: post #10
wyldfire wrote: post #9

Earlier quoted context omitted.

But a fix should come via the normal update channel soon? I'm on wily, should I expect to add this PPA or risk vulnerability?

Ubuntu should announce the fix at https://www.ubuntu.com/usn/ but I can't load the page right now. (removed DSA link as per advice below)

That Debian advisory is a different, older vulnerability. Looks like they know about it but haven't released anything yet:

https://security-tracker.debian.org/tracker/source-package/g...

Re: Server and Client RCE in Git version 2.7.1 and below

#14

Post by sytse »

sytse wrote: post #12
0x0 wrote: post #2

Sounds like this could be a big deal for bitbucket.org and gitlab.com? Esp. considering private repositories there.

For sure a big deal, we're deploying GitLab.com as we speak https://twitter.com/gitlabstatus/status/709888872549847040

And GitLab.com us updated. If someone finds anything please contact us https://about.gitlab.com/disclosure/

Re: Server and Client RCE in Git version 2.7.1 and below

#15

Post by sytse »

sytse wrote: post #11
Mojah wrote: post #6

A couple of thoughts on the potential impact: https://ma.ttias.be/remote-code-execution-git-versions-clien... Server-side: github & bitbucket will get patched quickly, if they're even still vulnerable. Self-hosted installations like Gitlab will be more difficult, as it requires sysadmins to patch themselves. History has thought us this takes too long. Client-side: possibly the biggest impact, as nearly every Linux di…

At GitLab this was fixed with https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3240 which we plan to release tomorrow in 8.5.7 https://gitlab.com/gitlab-org/gitlab-ce/issues/14308

You can already download the fixed packages of 8.5.7 right now.

Re: Server and Client RCE in Git version 2.7.1 and below

#16

Post by voltagex_ »

0x0 wrote: post #13
voltagex_ wrote: post #10

Earlier quoted context omitted.

Ubuntu should announce the fix at https://www.ubuntu.com/usn/ but I can't load the page right now. (removed DSA link as per advice below)

That Debian advisory is a different, older vulnerability. Looks like they know about it but haven't released anything yet: https://security-tracker.debian.org/tracker/source-package/g...

Oops, thanks.

Re: Server and Client RCE in Git version 2.7.1 and below

#17

Post by sytse »

sytse wrote: post #15
sytse wrote: post #11

Earlier quoted context omitted.

At GitLab this was fixed with https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3240 which we plan to release tomorrow in 8.5.7 https://gitlab.com/gitlab-org/gitlab-ce/issues/14308

You can already download the fixed packages of 8.5.7 right now.

And the blog post is out https://about.gitlab.com/2016/03/16/gitlab-8-dot-5-dot-7-rel...

Re: Server and Client RCE in Git version 2.7.1 and below

#18

Post by dfc »

Mojah wrote: post #6

A couple of thoughts on the potential impact: https://ma.ttias.be/remote-code-execution-git-versions-clien... Server-side: github & bitbucket will get patched quickly, if they're even still vulnerable. Self-hosted installations like Gitlab will be more difficult, as it requires sysadmins to patch themselves. History has thought us this takes too long. Client-side: possibly the biggest impact, as nearly every Linux di…

  >  includes any PHP, Ruby or Python site that allows
  >  shell commands to be executed
So any site already vulnerable to arbitrary command execution will now be vulnerable to RCE via arbitrary command execution? If your site currently allows arbitrary shell command execution the game was already lost.

  >  It has all the potential to be huge.
Really? The vulnerability on the client side is limited to a very small percentage of the internet users. Furthermore these users are much more likely to be aware of the vulnerability and upgrade compared to grandma and her flash plugin. The story is not that different on the server. The number of publicly accessible git daemons pales in comparison to apache or services that use openssl. As mentioned above this does not really change anything for sites that allow arbitrary shell command execution.

Running around like chicken little saying the sky is going to potentially fall is not productive and in the long run will probably not bring about the desired result for your page views...

Re: Server and Client RCE in Git version 2.7.1 and below

#20

Post by k1t »

mappu wrote: post #19

Times like this i'm glad i'm still on Mercurial (no `strcpy` overflows in Python). Is anyone planning on writing a DVCS in Rust?

Almost certainly.

Which reminds me of a (partial) Haskell git implementation: http://stefan.saasen.me/articles/git-clone-in-haskell-from-t...

Previously posted to HN a number times, e.g. https://news.ycombinator.com/item?id=8713328

Post reply on HN