Описание
ELSA-2020-1980: git security update (IMPORTANT)
[2.18.4-2]
- Update to release 2.18.4
- Resolves: CVE-2020-11008
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
git
2.18.4-2.el8_2
git-all
2.18.4-2.el8_2
git-core
2.18.4-2.el8_2
git-core-doc
2.18.4-2.el8_2
git-daemon
2.18.4-2.el8_2
git-email
2.18.4-2.el8_2
git-gui
2.18.4-2.el8_2
git-instaweb
2.18.4-2.el8_2
git-subtree
2.18.4-2.el8_2
git-svn
2.18.4-2.el8_2
gitk
2.18.4-2.el8_2
gitweb
2.18.4-2.el8_2
perl-Git
2.18.4-2.el8_2
perl-Git-SVN
2.18.4-2.el8_2
Oracle Linux x86_64
git
2.18.4-2.el8_2
git-all
2.18.4-2.el8_2
git-core
2.18.4-2.el8_2
git-core-doc
2.18.4-2.el8_2
git-daemon
2.18.4-2.el8_2
git-email
2.18.4-2.el8_2
git-gui
2.18.4-2.el8_2
git-instaweb
2.18.4-2.el8_2
git-subtree
2.18.4-2.el8_2
git-svn
2.18.4-2.el8_2
gitk
2.18.4-2.el8_2
gitweb
2.18.4-2.el8_2
perl-Git
2.18.4-2.el8_2
perl-Git-SVN
2.18.4-2.el8_2
Связанные CVE
Связанные уязвимости
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through sy...
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through sy...
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through syste
Affected versions of Git have a vulnerability whereby Git can be trick ...