RE: [bug] encryption of metadata in .git metadata file inside .git folder

From: rsbecker@nexbridge.com <rsbecker@nexbridge.com>
Date: Dec 23, 2024, 14:28 UTC
Message-ID: <000a01db5546$f034b7a0$d09e26e0$@nexbridge.com>
In-Reply-To: <CAMmT1pJ0ReaX+g2_gFQ2oLUrzhR5wCXGvCj_WwDMXcfG2DNG_g@mail.gmail.com>

On December 23, 2024 7:04 AM, Krishnamurthy Ganesh B wrote:

Show 21 quoted lines

>i am raising a git security red flag on the.git metadata files storing git logs, commits,
>and other metadata inside .git folder not encrypted using a two way salt or some
>other way like using a key for a two way encryption or some method of software
>encryption internally if / because the .git folder metadata is not encrypted.
>
>this has been raised to github before but will be raised again via hackerone security
>bug and to gitlab and altassian and other git repository source users if they are
>using their own internal modified sources.
>
>most of the errors like these will be directly closed.
>
>https://kondukto.io/blog/git-scm-affected-by-cve-2024-32002
>
>https://socradar.io/critical-security-updates-for-git-scm-cve-2024-32002-cve-
>2024-32004-lead-to-rce/
>
>https://stackoverflow.com/questions/45578579/what-file-metadata-is-
>preserved-by-git
>
>even packages like git-crypt do not encrypt metadata.
>https://github.com/AGWA/git-crypt

Have you explored using disk-level encryption to solve this? While I understand your objective to "encrypt anything that might have data in it", there are solutions independent of git what would cover most use cases. The problem with adding symmetrical encryption to git is that it opens git up to export limitations and related CVEs. It would also cause adoption issues with many organizations who may have restrictions on whatever techniques git adopts to solve this. My preferential solution is using COTS hardware encryption to solve protecting data-at-rest content.

--Randall