Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block insecure options and protocols by default #1521

Merged
merged 7 commits into from Dec 29, 2022
Merged

Block insecure options and protocols by default #1521

merged 7 commits into from Dec 29, 2022

Conversation

stsewd
Copy link
Contributor

@stsewd stsewd commented Dec 24, 2022

This got a little longer than expected 😮‍💨, there were other places where git accepted ext:: URLs, like git pull/push/fetch <URL> https://git-scm.com/docs/git-remote-ext#_examples

And there are other config options that can be harmful, so I think we should just forbid the --config option, if anyone is relying on that option, they can opt-out with allow_unsafe_options=True.

--*-pack and --exec are the options that I found that could lead to RCE, but anyone allowing users to pass arbitrary options should be aware that it may be more of these, don't know.

This is still missing adding/updating tests.

This is on top of #1516
Fixes #1515

s-t-e-v-e-n-k and others added 2 commits December 23, 2022 16:16
@s-t-e-v-e-n-k @stsewd
Forbid unsafe protocol URLs in Repo.clone{,_from}()
2625ed9 
Since the URL is passed directly to git clone, and the remote-ext helper
will happily execute shell commands, so by default disallow URLs that
contain a "::" unless a new unsafe_protocols kwarg is passed.
(CVE-2022-24439)

Fixes gitpython-developers#1515
@stsewd
Block unsafe options and protocols by default
e6108c7
Byron
Byron requested changes Dec 24, 2022
View reviewed changes
Copy link
Member

@Byron Byron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much for having put in so much time and effort to help fixing this!

It mostly looks good to me, and once CI is working there shouldn't be much in the way of merging the PR.

git/cmd.py Outdated Show resolved Hide resolved
test/test_repo.py Outdated Show resolved Hide resolved
git/remote.py Outdated Show resolved Hide resolved
@stsewd stsewd marked this pull request as ready for review December 28, 2022 01:12
@stsewd
Copy link
Contributor Author

stsewd commented Dec 28, 2022

I have added/updated the tests.

Byron
Byron approved these changes Dec 28, 2022
View reviewed changes
Copy link
Member

@Byron Byron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much, this is tremendous work and great value for GitPython and all of its users. If you would like more recognition for this, please feel free to add an entry to changes.rst and include your name if you want. The same goes for the authors file.

That said, and if you feel you have a little more time and patience, I generally thought that asserting that these pwn files exist or don't exists where it's easily possible would help readability a lot while adding some assurance that it's actually, effectively working like it should. After all, having an exception raised is a side-effect of us ideally stopping the git command to be executed, but we don't really know unless we fail to observe its side-effect that we are trying to prevent.

If you don't have time, that's alright as well, just let me know and I will merge as is and get a new release ready.

Thanks so much!

test/test_remote.py Show resolved Hide resolved
test/test_repo.py Show resolved Hide resolved
@stsewd stsewd mentioned this pull request Dec 28, 2022
Closed
@stsewd
Copy link
Contributor Author

stsewd commented Dec 29, 2022

Thanks so much, this is tremendous work and great value for GitPython and all of its users. If you would like more recognition for this, please feel free to add an entry to changes.rst and include your name if you want. The same goes for the authors file.

Thank you!

If you don't have time, that's alright as well, just let me know and I will merge as is and get a new release ready.

I'll try to update the PR later today or tomorrow

@Byron Byron added this to the v3.1.30 - Bugfixes milestone Dec 29, 2022
@Byron
Copy link
Member

Byron commented Dec 29, 2022

🙏🎉

@Byron Byron merged commit 678a8fe into gitpython-developers:main Dec 29, 2022
6 checks passed
@Byron Byron mentioned this pull request Dec 29, 2022
Closed
@stsewd stsewd deleted the block-insecure-options branch December 29, 2022 13:53
openstack-mirroring pushed a commit to openstack/openstack that referenced this pull request Jan 10, 2023
@openstack-gerrit
Update git submodules
083384d 
* Update requirements from branch 'master'
  to 2aaf64dd91c63aa55f4cbe8c037a6f545e91b302
  - Merge "Bump GitPython to 3.1.30"
  - Bump GitPython to 3.1.30
    
    3.1.30 includes 2 sets of fixes for CVE-2022-24439:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24439
      gitpython-developers/GitPython#1515
    
    PRs:
      gitpython-developers/GitPython#1518
      gitpython-developers/GitPython#1521
    
    Signed-off-by: Lon Hohberger <[email protected]>
    Change-Id: I0def2d9801f0b20fcc9b613165a29dbced1fd2d7
openstack-mirroring pushed a commit to openstack/requirements that referenced this pull request Jan 10, 2023
@lhh
Bump GitPython to 3.1.30
614ef65 
3.1.30 includes 2 sets of fixes for CVE-2022-24439:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24439
  gitpython-developers/GitPython#1515

PRs:
  gitpython-developers/GitPython#1518
  gitpython-developers/GitPython#1521

Signed-off-by: Lon Hohberger <[email protected]>
Change-Id: I0def2d9801f0b20fcc9b613165a29dbced1fd2d7
@HebaruSan HebaruSan mentioned this pull request Jan 16, 2023
Closed
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Jan 20, 2023
py-gitpython: updated to 3.1.30
8b50322 
3.1.30
- Make injections of command-invocations harder or impossible for clone and others.
  See gitpython-developers/GitPython#1518 for details.
  Note that this might constitute a breaking change for some users, and if so please
  let us know and we add an opt-out to this.
- Prohibit insecure options and protocols by default, which is potentially a breaking change,
  but a necessary fix for gitpython-developers/GitPython#1515.
  Please take a look at the PR for more information and how to bypass these protections
  in case they cause breakage: gitpython-developers/GitPython#1521.
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Jan 26, 2023
@nrpt-m @sakoman
python3-git: fix for CVE-2022-24439
55f93e3 
All versions of package gitpython are vulnerable to Remote Code Execution
(RCE) due to improper user input validation, which makes it possible to
inject a maliciously crafted remote URL into the clone command. Exploiting
this vulnerability is possible because the library makes external calls to
git without sufficient sanitization of input arguments.

CVE: CVE-2022-24439

Upstream-Status: Backport

Reference:
gitpython-developers/GitPython#1529
gitpython-developers/GitPython#1518
gitpython-developers/GitPython#1521

Signed-off-by: Narpat Mali <[email protected]>
stefan-hartmann-lgs pushed a commit to hexagon-geo-surv/poky that referenced this pull request Jan 27, 2023
@nrpt-m @rpurdie
python3-git: fix for CVE-2022-24439
0721360 
All versions of package gitpython are vulnerable to Remote Code Execution
(RCE) due to improper user input validation, which makes it possible to
inject a maliciously crafted remote URL into the clone command. Exploiting
this vulnerability is possible because the library makes external calls to
git without sufficient sanitization of input arguments.

CVE: CVE-2022-24439

Upstream-Status: Backport

Reference:
gitpython-developers/GitPython#1529
gitpython-developers/GitPython#1518
gitpython-developers/GitPython#1521

(From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde)

Signed-off-by: Narpat Mali <[email protected]>
Signed-off-by: Richard Purdie <[email protected]>
jpuhlman pushed a commit to MontaVista-OpenSourceTechnology/poky that referenced this pull request Jan 31, 2023
@nrpt-m @jpuhlman
python3-git: fix for CVE-2022-24439
88f3649 
Source: poky
MR: 124663
Type: Integration
Disposition: Merged from poky
ChangeID: 0721360
Description:

All versions of package gitpython are vulnerable to Remote Code Execution
(RCE) due to improper user input validation, which makes it possible to
inject a maliciously crafted remote URL into the clone command. Exploiting
this vulnerability is possible because the library makes external calls to
git without sufficient sanitization of input arguments.

CVE: CVE-2022-24439

Upstream-Status: Backport

Reference:
gitpython-developers/GitPython#1529
gitpython-developers/GitPython#1518
gitpython-developers/GitPython#1521

(From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde)

Signed-off-by: Narpat Mali <[email protected]>
Signed-off-by: Richard Purdie <[email protected]>
Signed-off-by: Jeremy A. Puhlman <[email protected]>
@Beuc Beuc mentioned this pull request Jul 10, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Byron Byron Byron approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
v3.1.30 - Bugfixes
Development

Successfully merging this pull request may close these issues.

CVE-2022-24439: <gitpython::clone> 'ext::sh -c touch% /tmp/pwned' for remote code execution
3 participants
@stsewd @Byron @s-t-e-v-e-n-k