Stay Secure with the Latest Linux Advisories

security advisorycritical issuedebian

Debian: DSA-4657-1 Critical: Git Credential Leak Exploit

Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4657-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso April 14, 2020 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : git CVE ID : CVE-2020-5260 Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. For the oldstable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u6. For the stable distribution (buster), this problem has been fixed in version 1:2.20.1-2+deb10u2. We recommend that you upgrade your git packages. For the detailed security status of git please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/git Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian releases urgent security notice for git threatening credential details through manipulated URL; users are urged to update.. Debian Security Advisory, Git Credential Exploit, Project Zero Fix. . Severity: Critical. LinuxSecurity.com Team

Apr 14, 2020 •Critical Debian