[HN Gopher] Git Security Vulnerability Announced
       ___________________________________________________________________
        
       Git Security Vulnerability Announced
        
       Author : todsacerdoti
       Score  : 15 points
       Date   : 2022-04-12 17:52 UTC (5 hours ago)
        
 (HTM) web link (github.blog)
 (TXT) w3m dump (github.blog)
        
       | csense wrote:
       | So wait a minute. The situation here is that a directory Alice
       | owns is a subdirectory of a directory Eve owns.
       | 
       | I find it highly surprising that anyone would configure a multi-
       | user machine where a parent directory is owned by an untrusted
       | user different from the current user. Usually a parent directory
       | would be owned by the same user as the current directory, root,
       | or possibly a system service account.
       | 
       | Although now that I think about it, /tmp might be an example --
       | if Eve is a local user, she can create /tmp/.git. Then if Alice
       | tries to use the git command in a subdirectory of /tmp that's not
       | already a Git repository, she might be bitten by this.
       | 
       | It's still a pretty far-fetched scenario, but I suppose it's
       | possible a non-zero number of users are affected.
       | 
       | Are multi-user machines even that common? I was under the
       | impression that most people don't really use OS level user
       | accounts, and instead use VM's or containers if they want to have
       | multiple people using the same physical box (especially if those
       | people are untrusted). AFAIK traditional Unix shared hosting is
       | mostly in the past.
       | 
       | I use Git regularly but I'm not going to lose any sleep over this
       | one.
        
         | nijave wrote:
         | Maybe (abused) jump servers or "admin" servers? (Those abused
         | catchall servers will scripts and crons that don't have their
         | own systems get thrown)
        
       | junon wrote:
       | Yet another case where the CVE system is absolutely broken. This
       | has no reason to be a "medium" vulnerability, just like regular
       | expression complexity DOS (redos) vulnerabilities have no
       | business being classified as "high risk" in the majority of cases
       | they're found.
       | 
       | CVE scoring is antiquated and obsolete IMO. It means nothing to
       | me anymore.
        
         | icegreentea2 wrote:
         | Do you think the scores in this case is too high or too low?
        
       | rosndo wrote:
       | > This vulnerability affects users working on multi-user machines
       | where a malicious actor could create a .git directory in a shared
       | location above a victim's current working directory. On Windows,
       | for example, an attacker could create C:\\.git\config, which
       | would cause all git invocations that occur outside of a
       | repository to read its configured values.
       | 
       | lol.
       | 
       | "vulnerability"
       | 
       | Neither of these were worth an announcement blog post.
        
         | nijave wrote:
         | On Windows, you can just put whatever you want in `git.cmd` to
         | achieve the same thing since it adds the current directory to
         | PATH implicitly
        
       ___________________________________________________________________
       (page generated 2022-04-12 23:02 UTC)