Skip to content

v2.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 05:50
v2.2.0
8f41267
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GitProxy v2.2.0 is a breaking release that patches five high-severity vulnerabilities. We strongly recommend upgrading existing deployments. For organizations using 2.0 and 2.1, we will provide non-breaking patches for all vulnerabilities except the push identity issue.

Upgrading to 2.2.0 should be straightforward: see the guide below for more details.

Vulnerability Fixes

Pusher identity fix

The largest, breaking change is how GitProxy determines the pusher's identity. Previously, it was obtained from the committer line of the pushed objects, which can be controlled by an attacker. In other words, a user could attribute a push to a colleague and then approve it themselves GHSA-m42c-5wg4-978p. Now, identity is resolved only from the authenticated session (or token). GitProxy will reject pushes whose identity cannot be established.

The guide below shows typical error messages along with the recommended fix.

SSH public key authentication fix

SSH public key authentication now verifies the client's signature. Previously, any key matching an entry in the user table was accepted without proof that the client actually held the private key GHSA-h37f-qp8m-g68c. This affected the first shipped versions of SSH, 2.1.0 and 2.1.1. The fix will also be backported to 2.1.2.

Commit replay approval bypass fix

Approvals are now bound to the repository, ref and contents they were granted for. An approval obtained in one repository can no longer be replayed to push the same commit range to another repository or branch GHSA-pm2x-94mw-m64f.

Arbitrary directory deletion fix

Ref updates are now validated as 40-character hex object IDs, and checkout paths are limited to the .remote directory. This prevents a path traversal vulnerability where users with push access could recursively delete directories the proxy could write to, including the .data database GHSA-293g-m6p5-4fqq.

Enforce limits on PACK decompression and contents, prevent memory exhaustion

PACK and pkt-line parsing enforces limits on decompressed size, object count and pkt-line count, so highly compressed or oversized pushes can no longer exhaust memory and CPU GHSA-w285-c89q-mg53.

Upgrading and troubleshooting

Configure your SCM provider

If you don't use a predefined SCM provider (GitHub, GitLab, Codeberg, Gitea), you must first add your provider's name, type and host to the scmProviders array in your proxy configuration (proxy.config.json).

Set your SCM username to the proxy URL

When pushing, you should make sure that the remote also has your SCM username attached. Check by running the following:

git remote -v

This will return something like this:

local   http://<proxy-url>:<port>/<repo-git-url> (fetch)
local   http://<proxy-url>:<port>/<repo-git-url> (push)

If your username is missing, you can edit it by running the following command:

git remote set-url local http://<username>@<proxy-url>:<port>/<repo-git-url>

If this isn't set correctly, you'll get an error like this on git push:

remote: Invalid username or token. Password authentication is not supported for Git operations.

Connect your SCM username to GitProxy

If you haven't done this already you'll get the following error on git push:

remote: running resolveUserFromToken...
remote:         Push blocked: github account 'jescalada' is not linked to a git-proxy user. Link it from your profile or ask an administrator.

In order to set it up, just open the Settings tab in your GitProxy profile (/dashboard/profile), and link your SCM account to the relevant provider:

image

Other issues?

If you encounter any other issues, feel free to open a discussion or mention it in our bi-weekly community calls.

Applicable fixes will be soon backported to 2.0.2 and 2.1.2. Many thanks to OSTIF @suidpit, and to @cla7aye15I4nd, for finding and reporting these issues.

What's Changed

🚀 Features

🐛 Bug Fixes

🧰 Maintenance

Full Changelog: v2.1.1...v2.2.0

Contributors

andypols, kriswest, and 6 other contributors
Assets 2
Loading