Bug 1169936 (CVE-2020-11008)

Created attachment 836155 [details]
git-2020-11008.bundle.xz

was made public

https://lkml.org/lkml/2020/4/20/1252

From	Junio C Hamano <>
Subject	[Announce] Git v2.26.2 and others
Date	Mon, 20 Apr 2020 11:02:55 -0700
	

    share

Today, the Git project is releasing the following Git versions:

    v2.26.2, v2.25.4, v2.24.3, v2.23.3, v2.22.4, v2.21.3, v2.20.4,
    v2.19.5, v2.18.4, and v2.17.5.

These releases address the security issue CVE-2020-11008, which is
similar to the recently addressed CVE-2020-5260.

Users of the affected maintenance tracks are urged to upgrade.

The tarballs are found at:

    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the 'v2.26.2'
and other tags:

  url = https://kernel.googlesource.com/pub/scm/git/git
  url = git://repo.or.cz/alt-git.git
  url = https://github.com/gitster/git

Attached below is the release notes for 2.17.5; all the newer
maintenance tracks listed at the beginning of this message are
updated with the same fix, so I won't repeat them here.

Thanks.

--------------------------------------------------
Git v2.17.5 Release Notes
=========================

This release is to address a security issue: CVE-2020-11008

Fixes since v2.17.4
-------------------

 * With a crafted URL that contains a newline or empty host, or lacks
   a scheme, the credential helper machinery can be fooled into
   providing credential information that is not appropriate for the
   protocol in use and host being contacted.

   Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the
   credentials are not for a host of the attacker's choosing; instead,
   they are for some unspecified host (based on how the configured
   credential helper handles an absent "host" parameter).

   The attack has been made impossible by refusing to work with
   under-specified credential patterns.

Credit for finding the vulnerability goes to Carlo Arenas.

Oops, this has caught me unprepared...

I have backported the fix to SUSE_SLE-15_Update and SUSE_SLE-12_Update so far (I am currently waiting for the build). Should I fix it also on SUSE_SLE-11-SP1_Update?

If possible please also backport for SLE11 SP1

sorry, I have to retract ... on SLE11 we no longer have any active product using "git" anymore. 

SO SLE11 git submissions are no longer needed.

(In reply to Marcus Meissner from comment #8)
> sorry, I have to retract ... on SLE11 we no longer have any active product
> using "git" anymore. 
> 
> SO SLE11 git submissions are no longer needed.

next time I will know, thanks :)

This is an autogenerated message for OBS integration:
This bug (1169936) was mentioned in
https://build.opensuse.org/request/show/797168 Factory / git

SUSE-SU-2020:1121-1: An update that solves 15 vulnerabilities and has 8 fixes is now available.

Category: security (moderate)
Bug References: 1063412,1095218,1095219,1110949,1112230,1114225,1132350,1149792,1156651,1158785,1158787,1158788,1158789,1158790,1158791,1158792,1158793,1158795,1167890,1168930,1169605,1169786,1169936
CVE References: CVE-2017-15298,CVE-2018-11233,CVE-2018-11235,CVE-2018-17456,CVE-2019-1348,CVE-2019-1349,CVE-2019-1350,CVE-2019-1351,CVE-2019-1352,CVE-2019-1353,CVE-2019-1354,CVE-2019-1387,CVE-2019-19604,CVE-2020-11008,CVE-2020-5260
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    git-2.26.1-3.25.2
SUSE Linux Enterprise Module for Development Tools 15-SP1 (src):    git-2.26.1-3.25.2
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    git-2.26.1-3.25.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-SU-2020:0598-1: An update that solves 15 vulnerabilities and has 8 fixes is now available.

Category: security (moderate)
Bug References: 1063412,1095218,1095219,1110949,1112230,1114225,1132350,1149792,1156651,1158785,1158787,1158788,1158789,1158790,1158791,1158792,1158793,1158795,1167890,1168930,1169605,1169786,1169936
CVE References: CVE-2017-15298,CVE-2018-11233,CVE-2018-11235,CVE-2018-17456,CVE-2019-1348,CVE-2019-1349,CVE-2019-1350,CVE-2019-1351,CVE-2019-1352,CVE-2019-1353,CVE-2019-1354,CVE-2019-1387,CVE-2019-19604,CVE-2020-11008,CVE-2020-5260
Sources used:
openSUSE Leap 15.1 (src):    git-2.26.1-lp151.4.9.1

"Spring bug cleanup": I think this is fixed.

OK

SUSE-RU-2020:1340-1: An update that has 6 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1149792,1169786,1169936,1170302,1170741,1170939
CVE References: 
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    git-2.26.2-3.28.2
SUSE Linux Enterprise Module for Development Tools 15-SP1 (src):    git-2.26.2-3.28.2
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    git-2.26.2-3.28.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-RU-2020:0708-1: An update that has 6 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1149792,1169786,1169936,1170302,1170741,1170939
CVE References: 
Sources used:
openSUSE Leap 15.1 (src):    git-2.26.2-lp151.4.12.1

This is an autogenerated message for OBS integration:
This bug (1169936) was mentioned in
https://build.opensuse.org/request/show/816877 15.2 / git

openSUSE-RU-2020:0863-1: An update that has 6 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1149792,1169786,1169936,1170302,1170741,1170939
CVE References: 
Sources used:
openSUSE Leap 15.2 (src):    git-2.26.2-lp152.2.3.1

Done