* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Wednesday, September 10, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Palmetto Sports & Entertainment to air Columbia Fireflies playoff games – WIS News 10

    Catch Every Thrilling Moment: Palmetto Sports & Entertainment to Broadcast Columbia Fireflies Playoff Games!

    Jobs roundup: September 2025 | Blizzard Entertainment appoints Walter Kong SVP of live games/mobile development – GamesIndustry.biz

    Blizzard Entertainment Names Walter Kong as SVP of Live Games and Mobile Development in September 2025 Jobs Update

    Monumental Sports & Entertainment Sets Corporate Direction at Nasdaq – PR Newswire

    Monumental Sports & Entertainment Reveals Bold New Corporate Vision at Nasdaq

    The Secret to What Made ‘CarJack’ Work on As the World Turns – yahoo.com

    The Surprising Secret Behind ‘CarJack’s’ Success on As the World Turns

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Pendulum Announce Homecoming 2026 Australian Tour – yahoo.com

    Pendulum Announces Thrilling Homecoming Tour Across Australia in 2026

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    ASE Technology (ASX) Hits Record High on AI Fuel – uk.finance.yahoo.com

    ASE Technology Rockets to New Heights Driven by Game-Changing AI Breakthroughs

    Tri-Counties Bank marks 50 years of growth with focus on technology and personal service – thebusinessjournal.com

    Tri-Counties Bank Celebrates 50 Years of Growth Driven by Technology and Personal Service

    AI will reshape internet, create jobs in West Virginia says High Technology Foundation’s Estep – WV News

    How AI Is Set to Transform the Internet and Boost Job Growth in West Virginia

    Industry partner provides Ferris State Plastics Engineering Technology students with state-of-the-art equipment to gain in-demand skills – Ferris State University

    Industry Partner Equips Ferris State Plastics Engineering Students with Cutting-Edge Technology to Boost In-Demand Skills

    Health Technology Ecosystem – Centers for Medicare & Medicaid Services | CMS (.gov)

    Discover the Future of Health Technology: Innovations Revolutionizing Patient Care

    Coherent Joins LLNL’s STARFIRE Diode Technology Working Group to Advance Inertial Fusion Energy – GlobeNewswire

    Coherent Partners with LLNL’s STARFIRE Team to Drive Breakthroughs in Inertial Fusion Energy

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Palmetto Sports & Entertainment to air Columbia Fireflies playoff games – WIS News 10

    Catch Every Thrilling Moment: Palmetto Sports & Entertainment to Broadcast Columbia Fireflies Playoff Games!

    Jobs roundup: September 2025 | Blizzard Entertainment appoints Walter Kong SVP of live games/mobile development – GamesIndustry.biz

    Blizzard Entertainment Names Walter Kong as SVP of Live Games and Mobile Development in September 2025 Jobs Update

    Monumental Sports & Entertainment Sets Corporate Direction at Nasdaq – PR Newswire

    Monumental Sports & Entertainment Reveals Bold New Corporate Vision at Nasdaq

    The Secret to What Made ‘CarJack’ Work on As the World Turns – yahoo.com

    The Surprising Secret Behind ‘CarJack’s’ Success on As the World Turns

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Pendulum Announce Homecoming 2026 Australian Tour – yahoo.com

    Pendulum Announces Thrilling Homecoming Tour Across Australia in 2026

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    ASE Technology (ASX) Hits Record High on AI Fuel – uk.finance.yahoo.com

    ASE Technology Rockets to New Heights Driven by Game-Changing AI Breakthroughs

    Tri-Counties Bank marks 50 years of growth with focus on technology and personal service – thebusinessjournal.com

    Tri-Counties Bank Celebrates 50 Years of Growth Driven by Technology and Personal Service

    AI will reshape internet, create jobs in West Virginia says High Technology Foundation’s Estep – WV News

    How AI Is Set to Transform the Internet and Boost Job Growth in West Virginia

    Industry partner provides Ferris State Plastics Engineering Technology students with state-of-the-art equipment to gain in-demand skills – Ferris State University

    Industry Partner Equips Ferris State Plastics Engineering Students with Cutting-Edge Technology to Boost In-Demand Skills

    Health Technology Ecosystem – Centers for Medicare & Medicaid Services | CMS (.gov)

    Discover the Future of Health Technology: Innovations Revolutionizing Patient Care

    Coherent Joins LLNL’s STARFIRE Diode Technology Working Group to Advance Inertial Fusion Energy – GlobeNewswire

    Coherent Partners with LLNL’s STARFIRE Team to Drive Breakthroughs in Inertial Fusion Energy

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

GitHub fixes race condition that could have led to ‘repojacking’

September 18, 2023
in Technology
GitHub fixes race condition that could have led to ‘repojacking’
Share on FacebookShare on Twitter

Jürgen Fälchle – stock.adobe.c

A subtle flaw in how GitHub handled repository creation and user renaming could have had serious consequences for the open source community, but has now been fixed. Learn more about how it worked

Alex Scroxton

By

Alex Scroxton,
Security Editor

Published: 13 Sep 2023 16:00

GitHub has fixed a race condition vulnerability in its repository creation and user renaming operations that could have enabled threat actors to perform what is known as a repojacking attack.

Discovered and disclosed by researchers from Checkmarx, had the flaw been exploited, it could have been used to take control of code repositories and hijack them to distribute malicious code. It would also have had bad implications for the reputations of those who fell victim to it.

“Repojacking is a technique where an attacker takes control of a GitHub repository by exploiting a logical flaw that renders renamed users vulnerable,” wrote Elad Rapoport of Checkmarx.

“The attacker hijacks a legitimate, often popular, namespace on GitHub. A namespace is the combination of the username and repo name, for example: example-user/example-repo.”

Namespaces on GitHub become vulnerable to repojacking when the original username is changed using the “user rename” feature. When a GitHub user renames themselves, GitHub does not set up redirects for their old profile page or Pages sites, but does create redirects for their repositories. Users are made aware of this via a pop-up during the process.

Unfortunately, in doing so, the old username also becomes available for anybody else to claim, so once the user has been successfully renamed, a malicious actor can claim their old username, open a repo under the matching repo name, and hijack the namespace.

Other flaws in this process have previously been identified and fixed, and GitHub did have protection measures available – notably retiring popular repositories (those with more than 100 clones at the time of renaming) so that the username couldn’t be taken.

However, Rapoport found he was able to bypass these fixes by taking advantage of a race condition between the creation of a repository and the renaming of a username, by almost simultaneously doing both – using an API request for repository creation and a renamed request interception for the username change.

“Successful exploitation enables the takeover of popular code packages in several package managers, including ‘Packagist,’ ‘Go,’ ‘Swift’ and more,” he said. “We have identified over 4,000 packages in those package managers using renamed usernames and are at risk of being vulnerable to this technique in case a new bypass is found. Of these packages at risk, hundreds of them have garnered over 1,000 stars on GitHub.

“In addition, exploiting this bypass can also result in a takeover of popular GitHub actions, which are also consumed by specifying a GitHub namespace. Poisoning a popular GitHub action could lead to major supply chain attacks with significant repercussions.”

Although this repojacking issue has been fixed, it is the fourth one found in the past couple of years – three in 2022 alone – and Rapoport said it spoke to persistent risks associated with the popular repository namespace retirement mechanism.

“Many GitHub users, including users that control popular repositories and packages, choose to use the ‘user rename’ feature GitHub offers,” he said. “For that reason, the attempt to bypass the ‘popular repository namespace retirement’ remains an attractive attack point for supply chain attackers with the potential to cause substantial damages.”

In spite of the fix, Checkmarx is recommending that users avoid using retired namespaces to minimise their attack surface, and make sure there are no code dependencies that may leave a GitHub repository vulnerable. It offers its own open source tool, Chainjacking, which can assist with this.

Read more on Web application security


Create a GitHub Personal Access Token example

CameronMcKenzie

By: Cameron McKenzie


Git commit config and credential confusion causes consternation for customers

CameronMcKenzie

By: Cameron McKenzie


Follow this Harness IO tutorial to get started with CI/CD

MichaelLevan

By: Michael Levan


Quick GitHub ‘Permission denied (publickey)’ SSH error fix

CameronMcKenzie

By: Cameron McKenzie

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : Computer Weekly – https://www.computerweekly.com/news/366552015/GitHub-fixes-race-condition-that-could-have-led-to-repojacking

Tags: fixesGitHubtechnology
Previous Post

BianLian ransomware gang holds Save the Children hostage

Next Post

GCHQ breached privacy rights of IT professional and security researcher, human rights court rules

How to Watch Ecuador vs. Argentina on TV, Live Stream: 2026 World Cup Qualifier – Sports Illustrated

Catch the Excitement: Your Ultimate Guide to Watching Ecuador vs. Argentina Live in the 2026 World Cup Qualifiers

September 10, 2025
Supreme Court to weigh legality of Trump’s tariffs in key economic case – The Washington Post

Supreme Court Poised to Decide the Future of Trump’s Controversial Tariffs in High-Stakes Economic Showdown

September 9, 2025
Palmetto Sports & Entertainment to air Columbia Fireflies playoff games – WIS News 10

Catch Every Thrilling Moment: Palmetto Sports & Entertainment to Broadcast Columbia Fireflies Playoff Games!

September 9, 2025
Behavioral Health Releases Project Evaluation Report for MHSA Innovation Round Four (FY 2021-2025) – County of San Luis Obispo (.gov)

Behavioral Health Unveils Exciting Project Evaluation Report for MHSA Innovation Round Four (FY 2021-2025)

September 9, 2025
Opinion | Gesture Politics Won’t Help Palestinians – The New York Times

Why Gesture Politics Fall Short in Supporting Palestinians

September 9, 2025
The making of an ecological disaster in the Nicobar – The Hindu

How Human Actions Sparked an Ecological Disaster in the Nicobar Islands

September 9, 2025
Science is under siege from weaponised disinformation – posing a threat to human civilisation – The Guardian

Science is under siege from weaponised disinformation – posing a threat to human civilisation – The Guardian

September 9, 2025
Two Harvard Scientists Finalists for Blavatnik Award – Harvard Gazette

Two Harvard Scientists Advance as Finalists for Prestigious Blavatnik Award

September 9, 2025
Why group chats drain you more than actual conversations — even when you hardly say a word – VegOut

Why Group Chats Exhaust You More Than Real Conversations-Even When You Say Almost Nothing

September 9, 2025
ASE Technology (ASX) Hits Record High on AI Fuel – uk.finance.yahoo.com

ASE Technology Rockets to New Heights Driven by Game-Changing AI Breakthroughs

September 9, 2025

Categories

Archives

September 2025
MTWTFSS
1234567
891011121314
15161718192021
22232425262728
2930 
« Aug    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (814)
  • Economy (833)
  • Entertainment (21,710)
  • General (16,948)
  • Health (9,875)
  • Lifestyle (846)
  • News (22,149)
  • People (835)
  • Politics (840)
  • Science (16,042)
  • Sports (21,332)
  • Technology (15,813)
  • World (815)

Recent News

How to Watch Ecuador vs. Argentina on TV, Live Stream: 2026 World Cup Qualifier – Sports Illustrated

Catch the Excitement: Your Ultimate Guide to Watching Ecuador vs. Argentina Live in the 2026 World Cup Qualifiers

September 10, 2025
Supreme Court to weigh legality of Trump’s tariffs in key economic case – The Washington Post

Supreme Court Poised to Decide the Future of Trump’s Controversial Tariffs in High-Stakes Economic Showdown

September 9, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version