Security fix for CVE-2020-5260

From the upstream [release notes](https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.17.
5.txt) :

> With a crafted URL that contains a newline or empty host, or lacks > a scheme, the credential helper machinery can be fooled into > providing credential information that is not appropriate for the > protocol in use and host being contacted. > > Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the > credentials are not for a host of the attacker's choosing; instead, > they are for some unspecified host (based on how the configured > credential helper handles an absent 'host' parameter). > > The attack has been made impossible by refusing to work with > under-specified credential patterns.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4334-1 advisory.

    Carlo Arenas discovered that Git incorrectly handled certain URLs containing newlines, empty hosts, or     lacking a scheme. A remote attacker could possibly use this issue to trick Git into returning credential     information for a wrong host.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1980 advisory.

    [2.18.4-2]
    - Update to release 2.18.4
    - Resolves: CVE-2020-11008

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external 'credential helper' programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a 'blank' pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's 'store' helper - Git's 'cache' helper - the 'osxkeychain' helper that     ships in Git's 'contrib' directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external 'credential helper' programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Affected versions of Git have a vulnerability whereby     Git can be tricked into sending private credentials to     a host controlled by an attacker. This bug is similar     to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that     bug still left the door open for an exploit where
    _some_ credential is leaked (but the attacker cannot     control which one). Git uses external 'credential     helper' programs to store and retrieve passwords or     other credentials from secure storage provided by the     operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git     versions can cause Git to send a 'blank' pattern to     helpers, missing hostname and protocol fields. Many     helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking     the password to an attacker's server. The vulnerability     can be triggered by feeding a malicious URL to `git     clone`. However, the affected URLs look rather     suspicious the likely vector would be through systems     which automatically clone URLs not visible to the user,     such as Git submodules, or package systems built around     Git. The root of the problem is in Git itself, which     should not be feeding blank input to helpers. However,     the ability to exploit the vulnerability in practice     depends on which helpers are in use. Credential helpers     which are known to trigger the vulnerability: - Git's     'store' helper - Git's 'cache' helper - the     'osxkeychain' helper that ships in Git's 'contrib'     directory Credential helpers which are known to be safe     even with vulnerable versions of Git: - Git Credential     Manager for Windows Any helper not in this list should     be assumed to trigger the     vulnerability.(CVE-2020-11008)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of git installed on the remote host is prior to 2.18.4-2.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1413 advisory.

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar toCVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for     that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has git packages installed that are affected by multiple vulnerabilities:

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2337 advisory.

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136001	Fedora 31 : git (2020-f6b3b6fb18)	Nessus	Fedora Local Security Checks	2020/4/27	2024/3/14	high
135895	Ubuntu 16.04 LTS / 18.04 LTS : Git vulnerability (USN-4334-1)	Nessus	Ubuntu Local Security Checks	2020/4/22	2024/8/29	high
136446	Oracle Linux 8 : git (ELSA-2020-1980)	Nessus	Oracle Linux Local Security Checks	2020/5/11	2024/10/22	high
153736	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-2549)	Nessus	Huawei Local Security Checks	2021/9/27	2022/1/20	high
145168	EulerOS 2.0 SP3 : git (EulerOS-SA-2021-1068)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	high
139093	Amazon Linux AMI : git (ALAS-2020-1413)	Nessus	Amazon Linux Local Security Checks	2020/7/30	2024/12/11	high
143893	NewStart CGSL CORE 5.04 / MAIN 5.04 : git Multiple Vulnerabilities (NS-SA-2020-0075)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2020/12/10	high
137006	CentOS 7 : git (RHSA-2020:2337)	Nessus	CentOS Local Security Checks	2020/6/2	2024/10/9	high

检测

插件搜索

high

high

high

high

high

high

high

high