Alternatively, a user could create that.git folder themselves and remove read/write access as workaround or 'define or extend 'GIT_CEILING_DIRECTORIES' to cover the parent directory of the user profile,' according to NIST. The flaws, tracked as CVE-2022-23521 and CVE-2022-41903, impacts the following versions of Git: v2.30.6, v2.31.5, v2.32.4, v2.33.5, v2.34.5, v2.35.5, v2.36.3, v2.37.4, v2.38.2, and v2.39.0. 'Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash.' The Git team was little blunter about the vulnerability, and warned that 'Merely having a Git-aware prompt that runs 'git status' (or 'git diff') and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user.' To deal with the issue, the Git team recommends an update. NIST went on to list potentially vulnerable products, which included Visual Studio. The result is that Git would use the config in the directory. In this case, the miscreants would only need to create the folder c.git, 'which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory,' according to NIST. ![]() From the report: Arguably, if an 'untrusted party' has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. In this case, the miscreants would only need to create the folder c.git, 'Which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory,' according to NIST. Specifically, the update is concerned with CVE-2022-24765. The update is solely concerned with CVE-2022-24765, an interesting bug which afflicts the Git for Windows fork of Git. Eritrea behind which they are trying to resolve the issue by absolute force. ![]() The Git team has issued an update to fix a bug in Git for Windows that 'affects multi-user hardware where untrusted parties have write access to the same hard disk,' reports The Register. Keep your code secure by using code scanning to identify and fix potential security vulnerabilities and other errors in your code.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |