Re: Possible bug reports for git-credential-libsecret

From: Junio C Hamano <gitster@pobox.com>
Date: Mar 18, 2022, 17:40 UTC
Message-ID: <xmqqtubv9n1i.fsf@gitster.g>
In-Reply-To: <CAPb83E-Y8grG7MVWqjqPH6SsdZ2JJ62XUeQAe=Wb_zgn0RL90A@mail.gmail.com>

"‍우승훈[ 대학원석·박사통합과정수료연구(재학) / 컴퓨터학과 ]" <seunghoonwoo@korea.ac.kr> writes:

> Recently, I noted that the vulnerability patch (CVE-2020-5260) for
> "git credential" is not applied in the "git-credential-libsecret"
> program (./contrib/credential/libsecret/git-credential-libsecret.c).

The code in credential.c touches the data directly obtained from the outside world. It opens a pipe to backends like credential-store and credential-libsecret and feeds the data that is cleansed by the code you saw in credential.c::credential_write_item() to these backends.

What these backends write come from these keyring storage systems. If you look at other backends in contrib/ and also credential-store and credential-cache, you'll see similar code to give "username=%s" and "password=%s" back to us in all of them.

Do you have a reason to suspect that these keyring storage systems the backends talk with can be as malicious as the data source the CVE patch tried to protect us against? If an attacker can already contaminate the contents of the keyrings these backends read from and write to, they do not have to use "git credential" as their attack vector, I would suspect.

So I would think it is natural to expect that the patch you saw is the only defence you need.