14 ms·

Critical security updates for Git, Subversion and Mercurial

366 points by mnw21cam 9y ago

bburky 9y ago
Wow, git's url bugs always seem to become easily exploitable due to .gitmodules. I found CVE-2015-7545 a few years ago, a malicious URL using the ext:: scheme could cause code execution. It was only easily exploitable because you can ask the client to fetch any URL you want via git submodules. (This vulneriblity was fixed, and since then the entire ext url scheme was disabled by default.)
icc97 9y ago
Kudos to Chocolatey on Windows, they immediately updated their Git package [0] to v2.14.1, so a simple `choco upgrade -y git` gets me up to date. If only life on Windows had always been this hassle free. [0]: https://chocolatey.org/packages/git https://chocolatey.org/packages/git
- czechdeveloper 9y ago
  Chocolatey is one of the best thinks that happened to Windows recently. It just makes my life so much simpler.
- colinramsay 9y ago
  Ditto for brew - I updated to 2.14.1 from there this morning.
  - chmike 9y ago
    How did you do this ? I just did a brew update && brew upgrade and still have git 2.13.0. I'm not an experienced mac user. EDIT: I followed directives given [here](https://medium.com/@katopz/how-to-upgrade-git-ff00ea12be18 https://medium.com/@katopz/how-to-upgrade-git-ff00ea12be18). I had git installed in /usr/local. I had to use the commands brew install git and brew link --overwrite git. I don't know if this was the correct way to do it.
- OhSoHumble 9y ago
  I really wish Chocolatey was more officially adopted by packagers. Often packages on there are outdated or just plain don't work... but, when they do work, it radically changes how software is installed on Windows.
  - oblio 9y ago
    I tried Chocolatey a while ago. Does it still install things all over the place by default? I with it could have some sort of install prefix, I'd use it then. Edit: it seems to have one.
    - nolok 9y ago
      Yes, you need to know the command line switch for each package/installer separately to install in the proper place. They have a switch to configure it once and have their tool figure out the right argument for each installer by itself, but it's only for paid users (~$96/year)
    - e12e 9y ago
      This is one benefit of scoop.sh - it's designed to isolate programs under your user profile, and not mess things up. A bit like using stow/xstow on gnu/bsd.
- skrebbel 9y ago
  Getting off topic fast, but I always found Chocolatey to be needlessly complicated and messy. I was very happy when I found http://scoop.sh http://scoop.sh. It's simpler and slightly less powerful, and most notably it just runs official installers in the background instead of copying binaries over from the source and packing them up in a special way. (It's also at the latest got already)
  - ericfrederich 9y ago
    Thanks for getting off-topic. These seem useful... until WSL becomes more mainstream. Part of my workflow involves using ncat.exe to use git over a socks/ssh proxy. A real pain. I noticed scoop has nc but not ncat.
    - skrebbel 9y ago
      I find `bash -c blablabla` works great for invoking the occasional Linux commands without moving to WSL entirely. (Actually I used to run all devtools, eg git and webpack I etc etc on WSL entirely but it still has too many quirks. Moved back to plain Windows recently and I'm happier)
      - pjmlp 9y ago
        Being on MS-DOS since 3.3, and being introduced to UNIX via Xenix, I have found out through the years that the best way is just to use the native CLI of each platform. For stuff that needs to run everywhere and I don't feel like writing two versions of scripts, I just use Python.
  - jpfed 9y ago
    >Getting off topic fast, but I always found Chocolatey to be needlessly complicated and messy. I haven't released it yet, but Napkin solves this very issue.
    - kakarot 9y ago
      Would you mind elaborating?
- hungerstrike 9y ago
  Does this vulnerability affect Windows? I don't even think it has an `ssh:` protocol handler.
  - ssawa 9y ago
    Natively Windows doesn't come with ssh no, but last I used it Git For Windows bundles a bunch of MinGW components, including ssh, which it calls out to.
    - icc97 9y ago
      Yep, I'm using that ssh too, it's really nice to have native ssh in Windows.
      - hdhzy 9y ago
        Git for Windows also ships with ssh-pageant that can use Pageant as key agent. Really useful if someone is using smartcard certificates (PIV, not GPG based).
- mdekkers 9y ago
  wow, chocolatey.org looks awesome. Thanks for the link!
- toxican 9y ago
  Maybe I needed to configure something, but I tried Chocolatey a little while ago on a fresh install of Windows and it seemed to take forever to do anything. Maybe I'm just spoiled by how quickly apt update and apt upgrade go, but it would hang for so long that I thought chocolatey had frozen.
  - yread 9y ago
    antivirus?
    - toxican 9y ago
      I don't think so. All I've got is Windows Defender and seeing as how that's a default program in 8 and 10, I'd expect a little more effort on Chocolatey's part to notifier users about that if it was the cause. I don't really get it. I did a fresh install of it a few minutes ago, gave the command to install 7zip. Then it downloaded the file, said it was installing, and it just sat there for 10-15 minutes before I got fed up and hit CTRL+C to cancel it. Then it kicked back into gear and magically finished the install somehow?
innocenat 9y ago
Just a note for everyone on Ubuntu, the fixed version for Ubuntu 16.04 is git v2.7.4-0ubuntu1.2 [0]. [0]: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000117.html https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2...
- lotsoflumens 9y ago
  Does anybody understand Ubuntu releases? The update this morning for Ubuntu 17.04 installs git 2.11.0 .. NOT the patched 2.11.3 NOR the latest 2.14.1 Why isn't Ubuntu fully up to date?
  - radarsat1 9y ago
    Came here to ask the same thing, running 17.04. I just did an update && dist-upgrade, still have git-2.11.0. Edit: The package is actually 2.11.0-2 which contains the security patch.
    - pawadu 9y ago
      This question is brought up every time this happens. Ubuntu uses stable (old) versions and does not upgrade to latest (unstable) releases very often. However, they do back port and apply security patches to these old versions. Point in case: 16.04 TLS is still on 2.7.4 but it is fully patched and secure.
      - lotsoflumens 9y ago
        This practice is seriously bad. It means that one group of developers is busy improving and fixing packages, and another different group is cherry-picking commits in order to maintain the illusion of stability (as mentioned above). That second group has to duplicate all the testing work done by the first group, and additionally ensure that there are no new problems introduced. It's very vulnerable to human error and adds a lot of unnecessary work.
        9y ago
rubayeet 9y ago
At the time of writing this, no official binary release for Mac[0], you have to build from source. [0]: https://git-scm.com/download/mac https://git-scm.com/download/mac
- johnhenry 9y ago
  Looks like it's already available through homebrew, if you use that.
  - tatoalo 9y ago
    Confirm, homebrew correctly updated & upgraded to git 2.14.1
  - fmitchell0 9y ago
    brew update && brew upgrade
    - Exuma 9y ago
      Or if you are on a fresh install of OSX or don't have git installed brew update && brew install git
    - pqdbr 9y ago
      If you just want to upgrade git, brew update && brew upgrade git
- deleted 9y ago
  [deleted]
captn3m0 9y ago
Arch Linux has the new package in testing: https://www.archlinux.org/packages/testing/i686/git/ https://www.archlinux.org/packages/testing/i686/git/
cyphar 9y ago
This was already submitted earlier today (https://news.ycombinator.com/item?id=14984044 https://news.ycombinator.com/item?id=14984044). It's actually quite easy to reproduce (the RCE aspect comes from the ProxyCommand and LocalCommand SSH options that you can set from the SSH command-line).
skj 9y ago
Report from the person who discovered the vulnerability: http://blog.recurity-labs.com/2017-08-10/scm-vulns http://blog.recurity-labs.com/2017-08-10/scm-vulns
ing33k 9y ago
on Ubuntu, use this PPA https://launchpad.net/~git-core/+archive/ubuntu/ppa https://launchpad.net/~git-core/+archive/ubuntu/ppa
- lotsoflumens 9y ago
  Thanks so much for pointing to this.
- pawadu 9y ago
  why PPA? the official release is already patched
diegoperini 9y ago
How can I do it on OSX without brew or port?
- ship_it 9y ago
  Compile manually from source?
- SCdF 9y ago
  I'm not sure where you got your git from (did it come with macos?) but I'd highly recommend you use something like brew. Not just for git, but for any tools you use honestly. MacOS very rarely patches this kind of thing, and in situations like this you need to be able to move fast.
  - tomjakubowski 9y ago
    > MacOS very rarely patches this kind of thing I think it's more accurate to say that Apple often takes their time patching these vulnerabilities. CVE‑2016‑2324 and CVE‑2016‑2315 were announced in March 2016 but Apple didn't release a patched version with Xcode until May 2016. Are there any major security vulnerabilities in git Apple hasn't yet released a patch for, other than this one? But yeah, Homebrew gets the patches out much faster. It's probably the right move to prefer using Homebrew's git to system git.
jomar 9y ago
A "ssh://..." URL can result in a "ssh" command line with a hostname that begins with a dash "-", which would cause the "ssh" command to instead (mis)treat it as an option. It's a shame, because the Git dispatching code ought to be able to invoke the ssh command via ssh -p 22 -etc -etc -- <hostname> to prevent interpreting options in <hostname>, thus defusing the in-band signalling causing this. But I suppose it can't depend on every ssh implementation understanding this "--" POSIX utility syntax guideline.
- numbsafari 9y ago
  How is this any different than a SQL-injection attack? Seems to me like git shouldn't be using the shell in order to invoke ssh at all.
  - jjnoakes 9y ago
    I haven't checked git, but even if git uses exec*() directly and skips the shell (which I suspect it does), the problem still exists. The issue isn't one of shell quoting, but one of ssh treating the argument list ["ssh", "-oProxyCommand=something", "remote-cmd"] not as ["ssh", hostname, command] but as ["ssh", option, hostname].
    - deckar01 9y ago
      There are C libraries for SSH, like libssh, that would avoid these type of vulnerabilities. https://www.libssh.org/ https://www.libssh.org/
      - peff 9y ago
        One downside of libraries like libssh is that they don't behave the same way as your regular ssh command. So thing you've configured like host aliases, proxy commands, etc, don't just work out of the box (and in some cases may not even be supported at all).
        9y ago
sickbeard 9y ago
and the link is dead..
HeadlessChild 9y ago
Fix has landed for Debian Jessie/Stretch in the security repo https://security-tracker.debian.org/tracker/CVE-2017-1000117 https://security-tracker.debian.org/tracker/CVE-2017-1000117
numbsafari 9y ago
I wonder how many "git client libraries" in various languages are also impacted by this.
- ethomson 9y ago
  I'm not familiar with any that exec ssh. Certainly libgit2 does not, nor do the language bindings on top of it. So libgit2, LibGit2Sharp, Rugged, Jagged, NodeGit are unaffected.
jjnoakes 9y ago
It's interesting to me that the fix was pattern matching the ssh hostname and banning a starting hyphen, rather than (say) passing "--" to ssh to signal the end of the intentional options so a hostname of "-oProxyCommand=whatever" is interpreted by ssh properly (as a hostname which can't be reached, instead of as a rogue argument). I thought this was a fairly well known way to pass arbitrary strings to commands and ensure they aren't interpreted as options (for commands which honor "--", like ssh does).
- peff 9y ago
  We discussed that, but it wasn't clear that doing so was portable. It works for OpenSSH. It doesn't for PuTTY. We don't know what other implementations people might have as `ssh` on their systems.
  - deleted 9y ago
    [deleted]
  - peterwwillis 9y ago
    It seems a little risky to assume separate clients/platforms will always interpret command line arguments the same way. At some point when a client breaks compatibility you have to implement methods to support the one-offs, or drop support. So for portability's sake, why not start writing those methods now, and have a generic universal method to fall back on for untested clients/versions? Or is that really unnecessary?
    - avar 9y ago
      How would a program like git figure out what flavor of "ssh" program is on the system? Keep in mind that it may change while a long-running git command is running.
      - deleted 9y ago
        [deleted]
  - pwdisswordfish 9y ago
aroberge 9y ago
This may be of interest to people using git on Windows and have malwarebytes installed. I tried to install a new version and found I could not as there was another version that was present. Git did not appear anywhere as a program to uninstall. I tried to delete it (from an admin account) and it failed with an access denied - and no other information. The solution was to use LockHunter (https://lockhunter.com/ https://lockhunter.com/) which informed me that malwarebytes was the program preventing me from deleting it. Using LockHunter, I removed the lock and successfully removed the old version of git.
djstein 9y ago
For MacOS users simply use: `brew install git` Then restart terminal instance.
VrEdxxx 9y ago
I wonder how can I do it on OSX without brew or port?
- justinclift 9y ago
  The next security release by Apple may include it. It's not uncommon to see open source library/utility updates in their change logs. eg: https://support.apple.com/en-us/HT207922 https://support.apple.com/en-us/HT207922
chungy 9y ago
> * In the same spirit, a repository name that begins with a dash "-" is also forbidden now. This will negatively affect https://github.com/nasser/--- https://github.com/nasser/---
avivo 9y ago
Is there any site where as security vulnerabilities are disclosed, you can see each what platform/contexts are affected, which have updated, and how to do that update?
- kakarot 9y ago
  Couple that with an API and notification system and you've got yourself a good service. My hands are a little full at this moment but feel free to shoot me an email if you're interested in doing something I like this. Seems like a good case for automation.
- bulatb 9y ago
  Maybe AppCanary? https://appcanary.com https://appcanary.com
the_common_man 9y ago
FYI, Cloudron has pushed out updates for Gitlab, Gogs (from their slack).
megous 9y ago
A lot of the time people use git to get source code to build and run on their computers. You can probably hide a nefarious code in many places, where it would be less noticeable, too, like pre-generated configure/Makefile.in scripts. I don't think anyone reads those. Another reason to welcome those new simpler configure/build systems like meson/ninja.
rloconne 9y ago
Where's the communication from Git itself about this? When I Google "critical git security update" I see this item, and stories from a few other outlets, but no notification from Git. Their release note for this release just says "This release forward-ports the fix for 'ssh://...' URL from Git v2.7.6". Nodejs has a page where they outline their procedure (https://nodejs.org/en/security/ https://nodejs.org/en/security/), with a list you can subscribe to. Does Git have something like that and I'm just missing it?

366 points by mnw21cam 9y ago

Wow, git's url bugs always seem to become easily exploitable due to .gitmodules. I found CVE-2015-7545 a few years ago, a malicious URL using the ext:: scheme could cause code execution. It was only easily exploitable because you can ask the client to fetch any URL you want via git submodules. (This vulneriblity was fixed, and since then the entire ext url scheme was disabled by default.)

icc97 9y ago

Kudos to Chocolatey on Windows, they immediately updated their Git package [0] to v2.14.1, so a simple `choco upgrade -y git` gets me up to date. If only life on Windows had always been this hassle free. [0]: https://chocolatey.org/packages/git https://chocolatey.org/packages/git

czechdeveloper 9y ago
Chocolatey is one of the best thinks that happened to Windows recently. It just makes my life so much simpler.
colinramsay 9y ago
Ditto for brew - I updated to 2.14.1 from there this morning.
- chmike 9y ago
  How did you do this ? I just did a brew update && brew upgrade and still have git 2.13.0. I'm not an experienced mac user. EDIT: I followed directives given [here](https://medium.com/@katopz/how-to-upgrade-git-ff00ea12be18 https://medium.com/@katopz/how-to-upgrade-git-ff00ea12be18). I had git installed in /usr/local. I had to use the commands brew install git and brew link --overwrite git. I don't know if this was the correct way to do it.
OhSoHumble 9y ago
I really wish Chocolatey was more officially adopted by packagers. Often packages on there are outdated or just plain don't work... but, when they do work, it radically changes how software is installed on Windows.
- oblio 9y ago
  I tried Chocolatey a while ago. Does it still install things all over the place by default? I with it could have some sort of install prefix, I'd use it then. Edit: it seems to have one.
  - nolok 9y ago
    Yes, you need to know the command line switch for each package/installer separately to install in the proper place. They have a switch to configure it once and have their tool figure out the right argument for each installer by itself, but it's only for paid users (~$96/year)
  - e12e 9y ago
    This is one benefit of scoop.sh - it's designed to isolate programs under your user profile, and not mess things up. A bit like using stow/xstow on gnu/bsd.
skrebbel 9y ago
Getting off topic fast, but I always found Chocolatey to be needlessly complicated and messy. I was very happy when I found http://scoop.sh http://scoop.sh. It's simpler and slightly less powerful, and most notably it just runs official installers in the background instead of copying binaries over from the source and packing them up in a special way. (It's also at the latest got already)
- ericfrederich 9y ago
  Thanks for getting off-topic. These seem useful... until WSL becomes more mainstream. Part of my workflow involves using ncat.exe to use git over a socks/ssh proxy. A real pain. I noticed scoop has nc but not ncat.
  - skrebbel 9y ago
    I find `bash -c blablabla` works great for invoking the occasional Linux commands without moving to WSL entirely. (Actually I used to run all devtools, eg git and webpack I etc etc on WSL entirely but it still has too many quirks. Moved back to plain Windows recently and I'm happier)
    - pjmlp 9y ago
      Being on MS-DOS since 3.3, and being introduced to UNIX via Xenix, I have found out through the years that the best way is just to use the native CLI of each platform. For stuff that needs to run everywhere and I don't feel like writing two versions of scripts, I just use Python.
- jpfed 9y ago
  >Getting off topic fast, but I always found Chocolatey to be needlessly complicated and messy. I haven't released it yet, but Napkin solves this very issue.
  - kakarot 9y ago
    Would you mind elaborating?
hungerstrike 9y ago
Does this vulnerability affect Windows? I don't even think it has an `ssh:` protocol handler.
- ssawa 9y ago
  Natively Windows doesn't come with ssh no, but last I used it Git For Windows bundles a bunch of MinGW components, including ssh, which it calls out to.
  - icc97 9y ago
    Yep, I'm using that ssh too, it's really nice to have native ssh in Windows.
    - hdhzy 9y ago
      Git for Windows also ships with ssh-pageant that can use Pageant as key agent. Really useful if someone is using smartcard certificates (PIV, not GPG based).
mdekkers 9y ago
wow, chocolatey.org looks awesome. Thanks for the link!
toxican 9y ago
Maybe I needed to configure something, but I tried Chocolatey a little while ago on a fresh install of Windows and it seemed to take forever to do anything. Maybe I'm just spoiled by how quickly apt update and apt upgrade go, but it would hang for so long that I thought chocolatey had frozen.
- yread 9y ago
  antivirus?
  - toxican 9y ago
    I don't think so. All I've got is Windows Defender and seeing as how that's a default program in 8 and 10, I'd expect a little more effort on Chocolatey's part to notifier users about that if it was the cause. I don't really get it. I did a fresh install of it a few minutes ago, gave the command to install 7zip. Then it downloaded the file, said it was installing, and it just sat there for 10-15 minutes before I got fed up and hit CTRL+C to cancel it. Then it kicked back into gear and magically finished the install somehow?

innocenat 9y ago

Just a note for everyone on Ubuntu, the fixed version for Ubuntu 16.04 is git v2.7.4-0ubuntu1.2 [0]. [0]: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000117.html https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2...

lotsoflumens 9y ago
Does anybody understand Ubuntu releases? The update this morning for Ubuntu 17.04 installs git 2.11.0 .. NOT the patched 2.11.3 NOR the latest 2.14.1 Why isn't Ubuntu fully up to date?
- radarsat1 9y ago
  Came here to ask the same thing, running 17.04. I just did an update && dist-upgrade, still have git-2.11.0. Edit: The package is actually 2.11.0-2 which contains the security patch.
  - pawadu 9y ago
    This question is brought up every time this happens. Ubuntu uses stable (old) versions and does not upgrade to latest (unstable) releases very often. However, they do back port and apply security patches to these old versions. Point in case: 16.04 TLS is still on 2.7.4 but it is fully patched and secure.
    - lotsoflumens 9y ago
      This practice is seriously bad. It means that one group of developers is busy improving and fixing packages, and another different group is cherry-picking commits in order to maintain the illusion of stability (as mentioned above). That second group has to duplicate all the testing work done by the first group, and additionally ensure that there are no new problems introduced. It's very vulnerable to human error and adds a lot of unnecessary work.
      - 9y ago

rubayeet 9y ago

At the time of writing this, no official binary release for Mac[0], you have to build from source. [0]: https://git-scm.com/download/mac https://git-scm.com/download/mac

johnhenry 9y ago
Looks like it's already available through homebrew, if you use that.
- tatoalo 9y ago
  Confirm, homebrew correctly updated & upgraded to git 2.14.1
- fmitchell0 9y ago
  brew update && brew upgrade
  - Exuma 9y ago
    Or if you are on a fresh install of OSX or don't have git installed brew update && brew install git
  - pqdbr 9y ago
    If you just want to upgrade git, brew update && brew upgrade git
deleted 9y ago
[deleted]

captn3m0 9y ago

Arch Linux has the new package in testing: https://www.archlinux.org/packages/testing/i686/git/ https://www.archlinux.org/packages/testing/i686/git/

cyphar 9y ago

This was already submitted earlier today (https://news.ycombinator.com/item?id=14984044 https://news.ycombinator.com/item?id=14984044). It's actually quite easy to reproduce (the RCE aspect comes from the ProxyCommand and LocalCommand SSH options that you can set from the SSH command-line).

skj 9y ago

Report from the person who discovered the vulnerability: http://blog.recurity-labs.com/2017-08-10/scm-vulns http://blog.recurity-labs.com/2017-08-10/scm-vulns

ing33k 9y ago

on Ubuntu, use this PPA https://launchpad.net/~git-core/+archive/ubuntu/ppa https://launchpad.net/~git-core/+archive/ubuntu/ppa

lotsoflumens 9y ago
Thanks so much for pointing to this.
pawadu 9y ago
why PPA? the official release is already patched

diegoperini 9y ago

How can I do it on OSX without brew or port?

ship_it 9y ago
Compile manually from source?
SCdF 9y ago
I'm not sure where you got your git from (did it come with macos?) but I'd highly recommend you use something like brew. Not just for git, but for any tools you use honestly. MacOS very rarely patches this kind of thing, and in situations like this you need to be able to move fast.
- tomjakubowski 9y ago
  > MacOS very rarely patches this kind of thing I think it's more accurate to say that Apple often takes their time patching these vulnerabilities. CVE‑2016‑2324 and CVE‑2016‑2315 were announced in March 2016 but Apple didn't release a patched version with Xcode until May 2016. Are there any major security vulnerabilities in git Apple hasn't yet released a patch for, other than this one? But yeah, Homebrew gets the patches out much faster. It's probably the right move to prefer using Homebrew's git to system git.

jomar 9y ago

A "ssh://..." URL can result in a "ssh" command line with a hostname that begins with a dash "-", which would cause the "ssh" command to instead (mis)treat it as an option. It's a shame, because the Git dispatching code ought to be able to invoke the ssh command via ssh -p 22 -etc -etc -- <hostname> to prevent interpreting options in <hostname>, thus defusing the in-band signalling causing this. But I suppose it can't depend on every ssh implementation understanding this "--" POSIX utility syntax guideline.

numbsafari 9y ago
How is this any different than a SQL-injection attack? Seems to me like git shouldn't be using the shell in order to invoke ssh at all.
- jjnoakes 9y ago
  I haven't checked git, but even if git uses exec*() directly and skips the shell (which I suspect it does), the problem still exists. The issue isn't one of shell quoting, but one of ssh treating the argument list ["ssh", "-oProxyCommand=something", "remote-cmd"] not as ["ssh", hostname, command] but as ["ssh", option, hostname].
  - deckar01 9y ago
    There are C libraries for SSH, like libssh, that would avoid these type of vulnerabilities. https://www.libssh.org/ https://www.libssh.org/
    - peff 9y ago
      One downside of libraries like libssh is that they don't behave the same way as your regular ssh command. So thing you've configured like host aliases, proxy commands, etc, don't just work out of the box (and in some cases may not even be supported at all).
      - 9y ago

sickbeard 9y ago

and the link is dead..

HeadlessChild 9y ago

Fix has landed for Debian Jessie/Stretch in the security repo https://security-tracker.debian.org/tracker/CVE-2017-1000117 https://security-tracker.debian.org/tracker/CVE-2017-1000117

numbsafari 9y ago

I wonder how many "git client libraries" in various languages are also impacted by this.

ethomson 9y ago
I'm not familiar with any that exec ssh. Certainly libgit2 does not, nor do the language bindings on top of it. So libgit2, LibGit2Sharp, Rugged, Jagged, NodeGit are unaffected.

jjnoakes 9y ago

It's interesting to me that the fix was pattern matching the ssh hostname and banning a starting hyphen, rather than (say) passing "--" to ssh to signal the end of the intentional options so a hostname of "-oProxyCommand=whatever" is interpreted by ssh properly (as a hostname which can't be reached, instead of as a rogue argument). I thought this was a fairly well known way to pass arbitrary strings to commands and ensure they aren't interpreted as options (for commands which honor "--", like ssh does).

peff 9y ago
We discussed that, but it wasn't clear that doing so was portable. It works for OpenSSH. It doesn't for PuTTY. We don't know what other implementations people might have as `ssh` on their systems.
- deleted 9y ago
  [deleted]
- peterwwillis 9y ago
  It seems a little risky to assume separate clients/platforms will always interpret command line arguments the same way. At some point when a client breaks compatibility you have to implement methods to support the one-offs, or drop support. So for portability's sake, why not start writing those methods now, and have a generic universal method to fall back on for untested clients/versions? Or is that really unnecessary?
  - avar 9y ago
    How would a program like git figure out what flavor of "ssh" program is on the system? Keep in mind that it may change while a long-running git command is running.
    - deleted 9y ago
      [deleted]
- pwdisswordfish 9y ago

aroberge 9y ago

This may be of interest to people using git on Windows and have malwarebytes installed. I tried to install a new version and found I could not as there was another version that was present. Git did not appear anywhere as a program to uninstall. I tried to delete it (from an admin account) and it failed with an access denied - and no other information. The solution was to use LockHunter (https://lockhunter.com/ https://lockhunter.com/) which informed me that malwarebytes was the program preventing me from deleting it. Using LockHunter, I removed the lock and successfully removed the old version of git.

djstein 9y ago

For MacOS users simply use: `brew install git` Then restart terminal instance.

VrEdxxx 9y ago

I wonder how can I do it on OSX without brew or port?

justinclift 9y ago
The next security release by Apple may include it. It's not uncommon to see open source library/utility updates in their change logs. eg: https://support.apple.com/en-us/HT207922 https://support.apple.com/en-us/HT207922

chungy 9y ago

> * In the same spirit, a repository name that begins with a dash "-" is also forbidden now. This will negatively affect https://github.com/nasser/--- https://github.com/nasser/---

avivo 9y ago

Is there any site where as security vulnerabilities are disclosed, you can see each what platform/contexts are affected, which have updated, and how to do that update?

kakarot 9y ago
Couple that with an API and notification system and you've got yourself a good service. My hands are a little full at this moment but feel free to shoot me an email if you're interested in doing something I like this. Seems like a good case for automation.
bulatb 9y ago
Maybe AppCanary? https://appcanary.com https://appcanary.com

the_common_man 9y ago

FYI, Cloudron has pushed out updates for Gitlab, Gogs (from their slack).

megous 9y ago

A lot of the time people use git to get source code to build and run on their computers. You can probably hide a nefarious code in many places, where it would be less noticeable, too, like pre-generated configure/Makefile.in scripts. I don't think anyone reads those. Another reason to welcome those new simpler configure/build systems like meson/ninja.

rloconne 9y ago

Where's the communication from Git itself about this? When I Google "critical git security update" I see this item, and stories from a few other outlets, but no notification from Git. Their release note for this release just says "This release forward-ports the fix for 'ssh://...' URL from Git v2.7.6". Nodejs has a page where they outline their procedure (https://nodejs.org/en/security/ https://nodejs.org/en/security/), with a list you can subscribe to. Does Git have something like that and I'm just missing it?