131–140 of 302 posts
Earlier quoted context omitted.
Or, an exploit was discovered, and quietly patched out recently
Oh, there it is: https://github.blog/2022-04-12-git-security-vulnerability-an...
> Merely navigating to such a space with a Git-enabled `PS1` when there is a maliciously-crafted `/scratch/.git/` can lead to a compromised account. I'm curious about this -- what's the attack vector here?
Couldn't that be mitigated by git adding a --readonly option that prevents any write operations? Then just use that option for any PS1 executables?
Earlier quoted context omitted.
It's a made-up title linking to some random commit. The new link tells you it's a fix for a vulnerability, the details, its CVE, affected platforms and use cases, etc, etc. The other thing doesn't.
The title was "made up", I'll give you that, but it's a pretty good paraphrase of the commit title to add context. The old link also tells you it's a fix for a vulnerability, and also explains how it affects all platforms, and also talks about the use cases etc etc. The only thing it doesn't have is a CVE number, which I don't think is all that important.
Just run your git checkouts in a container and then link the volume to other containers! /s
is_path_owned_by_current_uid(const char *path) isn't symlink safe given a multi-component path. Symlinks, the poisonous gift that keeps on giving.
Earlier quoted context omitted.
What do you mean by “git often installs”. Git does not install anything. Developers configure their PS1 or install something that does.
The default shell on Mac and a lot of Linux distros do this installation, as well as git for windows.
is_path_owned_by_current_uid(const char *path) isn't symlink safe given a multi-component path. Symlinks, the poisonous gift that keeps on giving.
Earlier quoted context omitted.
The title was "made up", I'll give you that, but it's a pretty good paraphrase of the commit title to add context. The old link also tells you it's a fix for a vulnerability, and also explains how it affects all platforms, and also talks about the use cases etc etc. The only thing it doesn't have is a CVE number, which I don't think is all that important.
The official announcement tells your that there's a vuln, it's considered important enough to break things and that it's out right now. The other thing tells you someone committed something a few weeks ago. The missing context also helps drive a lot of under-informed grumpy threads, rather than bettter-informed grumpy comments/threads. There'd have probably been fewer grumpy threads with the better link.
Earlier quoted context omitted.
The default shell on Mac and a lot of Linux distros do this installation, as well as git for windows.
Can you explain? A shell isn't supposed to be installing things on it's own... (Assuming you're talking about zsh or bash when you say shell.)
is_path_owned_by_current_uid(const char *path) isn't symlink safe given a multi-component path. Symlinks, the poisonous gift that keeps on giving.
I do not understand why symbolic links are "poisonous"? Can I get some context?
You can sort of think of a symlink as having 2 owners: the user that owns the symlink itself, and the user who owns the file pointed to by the symlink. One of those owners might be an attacker, so every time you interact with a file, you have to think "this file might be half-owned by an attacker, and half-owned by a victim".