[Discuss] Git Vulnerability

[Adam Parkin]

>> For this to actually turn into an exploit the attacker needs write
access to the git repository which is generally difficult to achieve

Unless I'm missing something, this would also work on a local clone of a
repo, since a local clone is just as much a Git repository as anything
that's remotely hosted.

>> am glad to see the free software mentality is still alive and well; in
the first URL above the git developers gave a big thanks to the mercurial
(!) developers for drawing this issue to their attention. And kudos to the
git developers for paying attention to the mercurial developers.

Totally agree, and the speed at which this bug was reported, fixed, and
deployed was exemplary.  Amazing how much cooperation and collaboration (as
opposed to "closed walls" & isolation) can facilitate critical fixes. :)

Adam

On Fri, Dec 19, 2014 at 1:06 PM, Alan W. Irwin <irwin at beluga.phys.uvic.ca>
wrote:
>
> On 2014-12-19 07:13-0800 Adam Parkin wrote:
>
>  Doesn't affect most Linux users (though they're still encouraged to
>> upgrade
>> as well), but if you're using Git on a case-insensitive filesystem there's
>> been a fairly nasty vulnerability discovered:
>>
>> http://article.gmane.org/gmane.linux.kernel/1853266
>> https://github.com/blog/1938-git-client-vulnerability-announced
>> http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-
>> 214-and-221-and.html
>>
>
> Thanks for bringing this to the attention of the list.  For this to
> actually turn into an exploit the attacker needs write access to the
> git repository which is generally difficult to achieve. So it sounds
> like a "due diligence" git client security update is needed (as
> opposed to an emergency security update) for the only platforms
> affected (Mac OS X and Windows).
>
> I am glad to see the free software mentality is still alive and well;
> in the first URL above the git developers gave a big thanks to the
> mercurial (!) developers for drawing this issue to their attention.
> And kudos to the git developers for paying attention to the mercurial
> developers. I just don't think you would see such cooperation and
> trust between proprietary software projects.
>
> Alan
> __________________________
> Alan W. Irwin
>
> Astronomical research affiliation with Department of Physics and Astronomy,
> University of Victoria (astrowww.phys.uvic.ca).
>
> Programming affiliations with the FreeEOS equation-of-state
> implementation for stellar interiors (freeeos.sf.net); the Time
> Ephemerides project (timeephem.sf.net); PLplot scientific plotting
> software package (plplot.sf.net); the libLASi project
> (unifont.org/lasi); the Loads of Linux Links project (loll.sf.net);
> and the Linux Brochure Project (lbproject.sf.net).
> __________________________
>
> Linux-powered Science
> __________________________
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://lists.vlug.org/mailman/listinfo/discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://vlug.org/pipermail/discuss_vlug.org/attachments/20141219/3758cdfe/attachment.html>