Re: Git vulnerability - execution of arbitrary code through .git/conf

2018-08-25 Thread Leo Silva (a.k.a kirotawa)
ah, cool! So, when a git clone is executed it generates a new .git/config to the local one (I didn't pay attention on that). Thanks a lot for the clarification Peff! On Sun, Aug 26, 2018 at 12:19 AM Jeff King wrote: > > On Sat, Aug 25, 2018 at 11:13:30PM -0300, Leo Silva (a.k.a kirotawa)

Re: Git vulnerability - execution of arbitrary code through .git/conf

2018-08-25 Thread Jeff King
On Sat, Aug 25, 2018 at 11:13:30PM -0300, Leo Silva (a.k.a kirotawa) wrote: > Hi git community! > > I found what seems to be a vulnerability/bug on git. I'm running > version 2.7.4 on Ubuntu xenial, but also tested with last version > 2.19.0.rc0.2.g29d9e3e. > > The steps to reproduce are: > >

Git vulnerability - execution of arbitrary code through .git/conf

2018-08-25 Thread Leo Silva (a.k.a kirotawa)
Hi git community! I found what seems to be a vulnerability/bug on git. I'm running version 2.7.4 on Ubuntu xenial, but also tested with last version 2.19.0.rc0.2.g29d9e3e. The steps to reproduce are: 1. open your .git/conf 2. add something like: [core] editor = ls /etc/passwd or even