Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git client vulnerability announced

github.com

Post reply on HN
Print view View original

11–20 of 191 posts

Re: Git client vulnerability announced

#12

Post by ethomson »

tlarkworthy wrote: post #3

> We have also completed an automated scan of all existing content on github.com to look for malicious content that might have been pushed to our site before this vulnerability was discovered did they find any problems? The post doesn't say...

Vicent Marti (from GitHub) states: "In case it's not obvious from the post: There are no malicious repos in @github and they can't be pushed anymore. Update your Git anyway."

https://twitter.com/vmg/status/545693913491984385

Re: Git client vulnerability announced

#13

Post by peff »

tlarkworthy wrote: post #3

> We have also completed an automated scan of all existing content on github.com to look for malicious content that might have been pushed to our site before this vulnerability was discovered did they find any problems? The post doesn't say...

We found 10 repositories which would have been blocked on push with the new restrictions. None of them were found to be malicious.

Re: Git client vulnerability announced

#14

Post by califield »

tptacek wrote: post #6
califield wrote: post #2

I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…

It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.

Yeah, but typically you have a certain level of trust in your project dependencies. Adding a library to your project often means granting access to your system anyway (if the dependency contains executable code).

Re: Git client vulnerability announced

#15

Post by tomp »

necubi wrote: post #8

Homebrew just updated ( https://github.com/Homebrew/homebrew/pull/35105 ), so Homebrew users should be covered by brew update && brew upgrade git

And don't copy&paste the above code into the terminal! (Potential vulnerability, though HN is probably safe.)

Re: Git client vulnerability announced

#16

Post by durin42 »

ngoldbaum wrote: post #4
califield wrote: post #2

I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…

The CVE affects mercurial as well according to the 3.2.3 release notes.

Yes, I asked for a CVE ID for hg but the mitre folks never got back to me.

Re: Git client vulnerability announced

#17

Post by baldfat »

>In addition, the following updated versions of Git address this vulnerability: Not everyone has the patch.

The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).

I have one Windows machine and went to update http://git-scm.com/download/win (preview Version 1.9.4)

It was released 3 months ago, on 2014-09-29.

https://msysgit.github.io (Version 1.9.5 preview BUT no documentation that this is for a security fix)

Doesn't seem like I can update my git client

Re: Git client vulnerability announced

#19

Post by peff »

califield wrote: post #14
tptacek wrote: post #6

Earlier quoted context omitted.

It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.

Yeah, but typically you have a certain level of trust in your project dependencies. Adding a library to your project often means granting access to your system anyway (if the dependency contains executable code).

You were and are vulnerable to malicious projects by running:

    git clone git://...
    make
or anything similar, since you are running arbitrary code out of the repository. This release fixes the problem of:

    git clone git://...
    git show
etc. Git cannot fix the "clone and run" problem, which is a social one. But it should be safe to run git commands to inspect the repository contents.

Re: Git client vulnerability announced

#20

Post by ethomson »

krschultz wrote: post #18
dshankar wrote: post #11

Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)

On Mac OS X, from Homebrew. The bug doesn't seem to affect Linux (most Linux file systems are case sensitive). I'm not sure about for Windows.

Definitely affects Windows. Git for Windows users should update to 1.9.5 immediately. https://msysgit.github.io/
Post reply on HN