archive mirror
 help / color / mirror / Atom feed
From: Jeremy Maitin-Shepard <>
Subject: Limitations of ownership checking fox for CVE-2022-24765
Date: Tue, 12 Apr 2022 21:42:29 -0700	[thread overview]
Message-ID: <> (raw)

The current fix for CVE-2022-24765 prevents unsafe command execution
in some cases but does not address all cases:

- Ownership by the current user should not be taken to mean "trusted":
the user may have retrieved a directory tree from an untrusted source,
  - Another version control system (which won't prevent a .git directory)
  - Unpacking an archive
  - FUSE mounting a remote filesystem

Additionally, the current fix requires additional configuration to
support existing use cases, and does not provide uses a way to safely
execute commands like `git status` or `git log` on untrusted

I think a better solution would be for git to support a `--safe`
option that only runs config-specified commands specifically added to
an allowed list, or if the repository itself has been added to

Ideally git would default to running in `--safe` mode, but if that is
too disruptive at least the option would be available for use in
prompt commands, etc.

(Please CC me in replies as I'm not subscribed to the list.)

             reply	other threads:[~2022-04-13  4:42 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-13  4:42 Jeremy Maitin-Shepard [this message]
2022-04-13 14:05 ` Limitations of ownership checking fox for CVE-2022-24765 Ævar Arnfjörð Bjarmason
2022-04-13 16:00   ` Jeremy Maitin-Shepard
2022-04-13 19:21     ` Ævar Arnfjörð Bjarmason

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='' \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).