CVE-2020-11008

Priority
Description
Affected versions of Git have a vulnerability whereby Git can be tricked
into sending private credentials to a host controlled by an attacker. This
bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug
still left the door open for an exploit where _some_ credential is leaked
(but the attacker cannot control which one). Git uses external "credential
helper" programs to store and retrieve passwords or other credentials from
secure storage provided by the operating system. Specially-crafted URLs
that are considered illegal as of the recently published Git versions can
cause Git to send a "blank" pattern to helpers, missing hostname and
protocol fields. Many helpers will interpret this as matching _any_ URL,
and will return some unspecified stored password, leaking the password to
an attacker's server. The vulnerability can be triggered by feeding a
malicious URL to `git clone`. However, the affected URLs look rather
suspicious; the likely vector would be through systems which automatically
clone URLs not visible to the user, such as Git submodules, or package
systems built around Git. The root of the problem is in Git itself, which
should not be feeding blank input to helpers. However, the ability to
exploit the vulnerability in practice depends on which helpers are in use.
Credential helpers which are known to trigger the vulnerability: - Git's
"store" helper - Git's "cache" helper - the "osxkeychain" helper that ships
in Git's "contrib" directory Credential helpers which are known to be safe
even with vulnerable versions of Git: - Git Credential Manager for Windows
Any helper not in this list should be assumed to trigger the vulnerability.
Assigned-to
mdeslaur
Notes
Package
Source: git (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (1:2.7.4-0ubuntu1.9)
Ubuntu 18.04 LTS (Bionic Beaver):released (1:2.17.1-1ubuntu0.7)
Ubuntu 19.10 (Eoan Ermine):released (1:2.20.1-2ubuntu1.19.10.3)
Ubuntu 20.04 LTS (Focal Fossa):released (1:2.25.1-1ubuntu3)
More Information

Updated: 2020-05-07 13:17:09 UTC (commit 9c52fbc2943459298ae6679cb4a2c01c5d1eed4d)