4 ms·
Fixing RCE vulnerabilities isn't something that should be debated about publicly.
by tylersmith 5y ago
Fixing RCE vulnerabilities isn't something that should be debated about publicly.
- hda2 5y agoNitpick: This isn't an RCE. An attacker would need 1) write access to a /local/ directory that the target will navigate to in his shell, and 2) convince the target to execute arbitrary git hooks in every directory (or parent directory) he visits by adding git to his shell's PS prompt. Besides, now that this security issue is patched, git devs should seek a proper solution to that doesn't break git and decrease security for everyone else.
- wonnage 5y agoThis isn't an RCE, you need to have control over the parent directory first which usually implies some sort of admin privileges already
- saagarjha 5y agoThis is just one way to fix the vulnerability. There are others, with different tradeoffs.