{"thread":{"id":"61763","subject":"Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387","startedAt":"2024-07-10T11:26:36Z","lastAt":"2024-07-23T16:36:31Z","messageCount":5,"participants":["Johannes Schindelin","Junio C Hamano","Dragan Simic"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"498437","messageId":"ffe00b81-5f19-a073-9a9e-ee84b7d3845b@gmx.de","threadId":"61763","inReplyTo":"AM9PR07MB71854BD4C1CE7E517203FFB6B1DF2@AM9PR07MB7185.eurprd07.prod.outlook.com","subject":"Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2024-07-10T11:26:32Z","receivedAt":"2024-07-10T11:26:36Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Michel,\n\nOn Fri, 5 Jul 2024, 'Schoonderwaldt, Michel' via Git Security wrote:\n\n> I am writing to bring to your attention a critical issue regarding the\n> version of OpenSSH included in the Git for Windows package. Recently, a\n> severe vulnerability (CVE-2024-6387) was disclosed, affecting versions\n> of OpenSSH from 8.5p1 up to and including 9.7p1. This vulnerability is a\n> regression of the earlier CVE-2006-5051, which was initially resolved in\n> OpenSSH version 4.4p1 but reintroduced in 8.5p1.\n\nThis description, while correct, is incomplete.\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-6387 has this to say:\n\n\tA security regression (CVE-2006-5051) was discovered in OpenSSH's\n\tserver (sshd). There is a race condition which can lead to sshd to\n\thandle some signals in an unsafe manner. An unauthenticated,\n\tremote attacker may be able to trigger it by failing to\n\tauthenticate within a set time period.\n\nThe crucial part is the `sshd` part. Git for Windows does distribute the\n`sshd.exe` binary, but it is in no way used by default, nor is there\nsupport how to set it up to run an SSH server.\n\nGit for Windows is therefore not affected by this vulnerability, and\ntherefore it is not crucial to get a new version out as quickly as\npossible. See also my assessment at\nhttps://github.com/git-for-windows/git/issues/5031#issuecomment-2199722969\n\nI take security very seriously. In some cases that dictates that I do\n_not_ rush out security bug-fix releases: Too many updates cause update\nfatigue, with the counterintuitive consequence that too many security\nbug-fix releases _decrease_ security. Therefore I assess carefully whether\nor not any given CVE in any given component that is distributed with Git\nfor Windows merits an out-of-band release. The regreSSHion CVE in question\ndoes not.\n\nHaving said that, the next official version is scheduled for July 29th (or\nsoon thereafter): https://gh.io/gitCal. This will contain the OpenSSH\nversion 9.8 that addressed that CVE.\n\nIf this is not soon enough for you, feel warmly welcome to install the\nmost recent snapshot from\nhttps://wingit.blob.core.windows.net/files/index.html; Git for Windows is\nkept in an always-releasable state, therefore I consider those snapshots\nto be equivalent to official releases with the only exception that they do\nnot have an official-looking version number (and aren't announced as\nprominently, either).\n\nCiao,\nJohannes\n\n> Given the popularity and widespread use of Git, it is crucial to ensure\n> that all included components are secure and up to date. Systems using\n> the affected versions of OpenSSH are at risk of exploitation, which\n> could lead to unauthorized access and other serious security issues.\n>\n> I would like to kindly request that the OpenSSH version included in the\n> Git for Windows package be updated to version 9.8/9.8p1 or higher, which\n> addresses these vulnerabilities. This update will help ensure the\n> security of all users who rely on Git for their development and\n> operational needs.\n>\n> Thank you for your attention to this matter. Please let me know if there\n> is any additional information you require.\n>\n> Met vriendelijke groet,\n>\n> Michel Schoonderwaldt\n> Senior ICT-specialist technische applicatie- en integratiebeheer  |  Team Informatiemanagement en ICT  |  Unit ICT\n> 046 477 71 96\n>\n> Werkdagen: maandag tot en met vrijdag, 08:30 - 17:00 uur\n>\n> Gemeente Sittard-Geleen  |  www.sittard-geleen.nl<http://www.sittard-geleen.nl/>\n> Adressen en openingstijden<https://www.sittard-geleen.nl/adressen>\n>\n> [cid:image001.png@01DACEEF.84479400]<http://www.facebook.com/sittardgeleen>     [cid:image002.png@01DACEEF.84479400] <https://www.instagram.com/gemeentesittardgeleen/>      [cid:image003.png@01DACEEF.84479400] <http://twitter.com/sittardgeleen>      [cid:image004.png@01DACEEF.84479400] <https://www.linkedin.com/company/sittard-geleen/>      [cid:image005.png@01DACEEF.84479400] <http://www.youtube.com/user/sittardgeleenonline>\n>\n> [cid:image006.jpg@01DACEEF.84479400]<https://www.sittard-geleen.nl/>\n>\n>\n> --\n> You received this message because you are subscribed to the Google Groups \"Git Security\" group.\n> To unsubscribe from this group and stop receiving emails from it, send an email to git-security+unsubscribe@googlegroups.com.\n> To view this discussion on the web visit https://groups.google.com/d/msgid/git-security/AM9PR07MB71854BD4C1CE7E517203FFB6B1DF2%40AM9PR07MB7185.eurprd07.prod.outlook.com.\n>\n"},{"id":"498469","messageId":"xmqqa5ipxjdr.fsf@gitster.g","threadId":"61763","inReplyTo":"ffe00b81-5f19-a073-9a9e-ee84b7d3845b@gmx.de","subject":"Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-07-10T17:10:56Z","receivedAt":"2024-07-10T17:11:02Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n\n> The crucial part is the `sshd` part. Git for Windows does distribute the\n> `sshd.exe` binary, but it is in no way used by default, nor is there\n> support how to set it up to run an SSH server.\n>\n> Git for Windows is therefore not affected by this vulnerability, and\n> therefore it is not crucial to get a new version out as quickly as\n> possible. See also my assessment at\n> https://github.com/git-for-windows/git/issues/5031#issuecomment-2199722969\n\nI think I've seen in the past another inquiry about vulnerability\nin OpenSSH, which turned out to be irrelevant in the context of Git\nfor Windows for this exact reason (i.e. \"sshd\" is problematic but\n\"ssh\" is OK).\n\nWould it make future confusion like this less likely if you stopped\nshipping the sshd and ship only the ssh client?\n\nThanks.\n"},{"id":"498471","messageId":"25ce4ec25b054cfbf4c540663c6b6c18@manjaro.org","threadId":"61763","inReplyTo":"xmqqa5ipxjdr.fsf@gitster.g","subject":"Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387","fromName":"Dragan Simic","fromEmail":"dsimic@manjaro.org","sentAt":"2024-07-10T17:23:26Z","receivedAt":"2024-07-10T17:23:30Z","isPatch":false,"sender":{"key":"dsimic@manjaro.org","avatar":null},"body":"On 2024-07-10 19:10, Junio C Hamano wrote:\n> Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n> \n>> The crucial part is the `sshd` part. Git for Windows does distribute \n>> the\n>> `sshd.exe` binary, but it is in no way used by default, nor is there\n>> support how to set it up to run an SSH server.\n>> \n>> Git for Windows is therefore not affected by this vulnerability, and\n>> therefore it is not crucial to get a new version out as quickly as\n>> possible. See also my assessment at\n>> https://github.com/git-for-windows/git/issues/5031#issuecomment-2199722969\n> \n> I think I've seen in the past another inquiry about vulnerability\n> in OpenSSH, which turned out to be irrelevant in the context of Git\n> for Windows for this exact reason (i.e. \"sshd\" is problematic but\n> \"ssh\" is OK).\n> \n> Would it make future confusion like this less likely if you stopped\n> shipping the sshd and ship only the ssh client?\n\nNot shipping sshd.exe would make sense regardless of the associated \nsecurity\nissues, because it would prevent accidental enabling of SSH access.  \nAlso, if\nsomeone wants to make SSHing into their Windows machine possible, I'm \npretty\nsure they won't do that by installing Git for Windows and using the \nshipped\nsshd.exe, but by some other means.\n\nIn other words, not shipping sshd.exe would not only reduce the likeness \nof\nhitting some security issues, but would also prevent accidental enabling \nof\nSSH access on a Windows machine.\n"},{"id":"499051","messageId":"a658fd0a-59bd-c162-874c-cc5b9926acd5@gmx.de","threadId":"61763","inReplyTo":"25ce4ec25b054cfbf4c540663c6b6c18@manjaro.org","subject":"Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2024-07-22T09:38:21Z","receivedAt":"2024-07-22T09:38:27Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Dragan,\n\nOn Wed, 10 Jul 2024, 'Dragan Simic' via Git Security wrote:\n\n> On 2024-07-10 19:10, Junio C Hamano wrote:\n> > Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n> >\n> > > The crucial part is the `sshd` part. Git for Windows does distribute the\n> > > `sshd.exe` binary, but it is in no way used by default, nor is there\n> > > support how to set it up to run an SSH server.\n> > >\n> > > Git for Windows is therefore not affected by this vulnerability, and\n> > > therefore it is not crucial to get a new version out as quickly as\n> > > possible. See also my assessment at\n> > > https://github.com/git-for-windows/git/issues/5031#issuecomment-2199722969\n> >\n> > I think I've seen in the past another inquiry about vulnerability\n> > in OpenSSH, which turned out to be irrelevant in the context of Git\n> > for Windows for this exact reason (i.e. \"sshd\" is problematic but\n> > \"ssh\" is OK).\n> >\n> > Would it make future confusion like this less likely if you stopped\n> > shipping the sshd and ship only the ssh client?\n>\n> Not shipping sshd.exe would make sense regardless of the associated security\n> issues, because it would prevent accidental enabling of SSH access.\n\nThere is little accidental about starting `sshd` after generating a valid\nhost key.\n\nHaving said that, `sshd` is not required to run Git, therefore it should\nnot be distributed with Git for Windows. This PR addresses that:\nhttps://github.com/git-for-windows/build-extra/pull/571\n\nThank you,\nJohannes\n"},{"id":"499175","messageId":"9b075f5b19bc6e31a0f4a829dbc623e8@manjaro.org","threadId":"61763","inReplyTo":"a658fd0a-59bd-c162-874c-cc5b9926acd5@gmx.de","subject":"Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387","fromName":"Dragan Simic","fromEmail":"dsimic@manjaro.org","sentAt":"2024-07-23T16:36:23Z","receivedAt":"2024-07-23T16:36:31Z","isPatch":false,"sender":{"key":"dsimic@manjaro.org","avatar":null},"body":"Hello Johannes,\n\nOn 2024-07-22 11:38, Johannes Schindelin wrote:\n> On Wed, 10 Jul 2024, 'Dragan Simic' via Git Security wrote:\n> \n>> On 2024-07-10 19:10, Junio C Hamano wrote:\n>> > Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n>> >\n>> > > The crucial part is the `sshd` part. Git for Windows does distribute the\n>> > > `sshd.exe` binary, but it is in no way used by default, nor is there\n>> > > support how to set it up to run an SSH server.\n>> > >\n>> > > Git for Windows is therefore not affected by this vulnerability, and\n>> > > therefore it is not crucial to get a new version out as quickly as\n>> > > possible. See also my assessment at\n>> > > https://github.com/git-for-windows/git/issues/5031#issuecomment-2199722969\n>> >\n>> > I think I've seen in the past another inquiry about vulnerability\n>> > in OpenSSH, which turned out to be irrelevant in the context of Git\n>> > for Windows for this exact reason (i.e. \"sshd\" is problematic but\n>> > \"ssh\" is OK).\n>> >\n>> > Would it make future confusion like this less likely if you stopped\n>> > shipping the sshd and ship only the ssh client?\n>> \n>> Not shipping sshd.exe would make sense regardless of the associated \n>> security\n>> issues, because it would prevent accidental enabling of SSH access.\n> \n> There is little accidental about starting `sshd` after generating a \n> valid\n> host key.\n\nWell, I don't know what and how Git for Windows does regarding the host\nkey generation, so the possibility of accidental starting the shipped\nsshd.exe may actually be quite low.\n\n> Having said that, `sshd` is not required to run Git, therefore it \n> should\n> not be distributed with Git for Windows. This PR addresses that:\n> https://github.com/git-for-windows/build-extra/pull/571\n\nInterestingly, that pull request shows that some people actually use(d)\nthe shipped sshd.exe, which just shows that nearly every change will\ninevitably break somebody's workflow.\n"}]}