An update of the git package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2337 advisory.

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has git packages installed that are affected by multiple vulnerabilities:

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external 'credential helper' programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a 'blank' pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's 'store' helper - Git's 'cache' helper - the 'osxkeychain' helper that     ships in Git's 'contrib' directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external 'credential helper' programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202004-13 (Git: Information disclosure)

    Multiple vulnerabilities have been discovered in Git. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by providing a specially crafted URL, could possibly       trick Git into returning credential information for a wrong host.
  Workaround :

    Disabling credential helpers will prevent this vulnerability.

Security fix for CVE-2020-5260

From the upstream [release notes](https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.17.
5.txt) :

> With a crafted URL that contains a newline or empty host, or lacks > a scheme, the credential helper machinery can be fooled into > providing credential information that is not appropriate for the > protocol in use and host being contacted. > > Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the > credentials are not for a host of the attacker's choosing; instead, > they are for some unspecified host (based on how the configured > credential helper handles an absent 'host' parameter). > > The attack has been made impossible by refusing to work with > under-specified credential patterns.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git to 2.26.2 fixes the following issues :

Security issue fixed :

CVE-2020-11008: Specially crafted URLs may have tricked the credentials helper to providing credential information that is not appropriate for the protocol in use and host being contacted (bsc#1169936).

Non-security issue fixed :

Fixed git-daemon not starting after conversion from sysvinit to systemd service (bsc#1169605).

Enabled access for git-daemon in firewall configuration (bsc#1170302).

Fixed problems with recent switch to protocol v2, which caused fetches transferring unreasonable amount of data (bsc#1170741).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Affected versions of Git have a vulnerability whereby     Git can be tricked into sending private credentials to     a host controlled by an attacker. This bug is similar     to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that     bug still left the door open for an exploit where
    _some_ credential is leaked (but the attacker cannot     control which one). Git uses external 'credential     helper' programs to store and retrieve passwords or     other credentials from secure storage provided by the     operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git     versions can cause Git to send a 'blank' pattern to     helpers, missing hostname and protocol fields. Many     helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking     the password to an attacker's server. The vulnerability     can be triggered by feeding a malicious URL to `git     clone`. However, the affected URLs look rather     suspicious the likely vector would be through systems     which automatically clone URLs not visible to the user,     such as Git submodules, or package systems built around     Git. The root of the problem is in Git itself, which     should not be feeding blank input to helpers. However,     the ability to exploit the vulnerability in practice     depends on which helpers are in use. Credential helpers     which are known to trigger the vulnerability: - Git's     'store' helper - Git's 'cache' helper - the     'osxkeychain' helper that ships in Git's 'contrib'     directory Credential helpers which are known to be safe     even with vulnerable versions of Git: - Git Credential     Manager for Windows Any helper not in this list should     be assumed to trigger the     vulnerability.(CVE-2020-11008)

  - Affected versions of Git have a vulnerability whereby     Git can be tricked into sending private credentials to     a host controlled by an attacker. Git uses external     'credential helper' programs to store and retrieve     passwords or other credentials from secure storage     provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject     unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the     password for one server (e.g., good.example.com) for an     HTTP request being made to another server (e.g.,     evil.example.com), resulting in credentials for the     former being sent to the latter. There are no     restrictions on the relationship between the two,     meaning that an attacker can craft a URL that will     present stored credentials for any host to a host of     their choosing. The vulnerability can be triggered by     feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious the likely vector     would be through systems which automatically clone URLs     not visible to the user, such as Git submodules, or     package systems built around Git. The problem has been     patched in the versions published on April 14th, 2020,     going back to v2.17.x. Anyone wishing to backport the     change further can do so by applying commit 9a6bbee     (the full release includes extra checks for git fsck,     but that commit is sufficient to protect clients     against the vulnerability). The patched versions are:
    2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2,     2.24.2, 2.25.3, 2.26.1.(CVE-2020-5260)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of git installed on the remote host is prior to 2.18.4-2.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1413 advisory.

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar toCVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for     that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
136697	Photon OS 2.0: Git PHSA-2020-2.0-0243	Nessus	PhotonOS Local Security Checks	5/18/2020	7/22/2024	high
137006	CentOS 7 : git (RHSA-2020:2337)	Nessus	CentOS Local Security Checks	6/2/2020	10/9/2024	high
143893	NewStart CGSL CORE 5.04 / MAIN 5.04 : git Multiple Vulnerabilities (NS-SA-2020-0075)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	12/10/2020	high
153736	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-2549)	Nessus	Huawei Local Security Checks	9/27/2021	1/20/2022	high
135949	GLSA-202004-13 : Git: Information disclosure	Nessus	Gentoo Local Security Checks	4/24/2020	3/14/2024	high
136001	Fedora 31 : git (2020-f6b3b6fb18)	Nessus	Fedora Local Security Checks	4/27/2020	3/14/2024	high
136789	SUSE SLES12 Security Update : git (SUSE-SU-2020:1295-1)	Nessus	SuSE Local Security Checks	5/22/2020	1/13/2021	high
137016	EulerOS 2.0 SP5 : git (EulerOS-SA-2020-1598)	Nessus	Huawei Local Security Checks	6/2/2020	3/8/2024	high
139093	Amazon Linux AMI : git (ALAS-2020-1413)	Nessus	Amazon Linux Local Security Checks	7/30/2020	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high