* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Tuesday, July 1, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Nantucket Dance Festival opens July 8 – The Inquirer and Mirror

    Nantucket Dance Festival Launches with Thrilling Performances Beginning July 8

    A Secret Society, Ritualistic Killings, and a Century-Old Curse Netflix and YRF Entertainment’s ‘Mandala Murders’ Premieres July 25 – About Netflix

    A Secret Society, Ritualistic Killings, and a Century-Old Curse: Dive into the Chilling World of ‘Mandala Murders’ Premiering July 25

    Susquehanna Raises Penn Entertainment Inc. (PENN) Price Target. – Yahoo Finance

    Susquehanna Raises Price Target for Penn Entertainment Inc. (PENN)

    George Lopez is coming to Spokane – KXLY.com

    George Lopez is coming to Spokane – KXLY.com

    Netflix unveils Dallas immersive venue for fans of hit shows like ‘Squid Game,’ ‘Stranger Things’ – Houston Chronicle

    Step Inside Netflix’s New Dallas Immersive Experience Featuring Hits Like ‘Squid Game’ and ‘Stranger Things

    ‘Puttin’ on the Ritz’: Civic Players bring ‘Young Frankenstein’ to life – Yahoo

    Civic Players Deliver a Hilarious and Unforgettable Performance of ‘Young Frankenstein

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Owls inspire new revolutionary noise reduction technology – KTEN

    Owls inspire new revolutionary noise reduction technology – KTEN

    New center coming to Mizzou will focus on energy research and technology – Columbia Missourian

    Mizzou Launches Innovative New Center Dedicated to Energy Research and Technology

    Mirrors in space and underwater curtains: can technology buy us enough time to save the Arctic ice caps? – The Guardian

    Can Technology Like Space Mirrors and Underwater Curtains Buy Us Time to Save the Arctic Ice Caps?

    Naples restaurant owner prepares for hurricane season with new flood technology – Fox4Now.com

    Naples restaurant owner prepares for hurricane season with new flood technology – Fox4Now.com

    Emerging Memory and Storage Technology Market Analysis Report 2025-2034 | AI and HPC Boom Fuels Surging Demand for Fast, Low-Power Memory Devices – Yahoo Finance

    How AI and HPC Are Driving Explosive Growth in Fast, Low-Power Memory Technologies Through 2034

    Ostin Technology (OST): Volatility’s Warning or Contrarian Opportunity? – AInvest

    Ostin Technology (OST): Navigating Market Volatility – Red Flag or Hidden Opportunity?

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Nantucket Dance Festival opens July 8 – The Inquirer and Mirror

    Nantucket Dance Festival Launches with Thrilling Performances Beginning July 8

    A Secret Society, Ritualistic Killings, and a Century-Old Curse Netflix and YRF Entertainment’s ‘Mandala Murders’ Premieres July 25 – About Netflix

    A Secret Society, Ritualistic Killings, and a Century-Old Curse: Dive into the Chilling World of ‘Mandala Murders’ Premiering July 25

    Susquehanna Raises Penn Entertainment Inc. (PENN) Price Target. – Yahoo Finance

    Susquehanna Raises Price Target for Penn Entertainment Inc. (PENN)

    George Lopez is coming to Spokane – KXLY.com

    George Lopez is coming to Spokane – KXLY.com

    Netflix unveils Dallas immersive venue for fans of hit shows like ‘Squid Game,’ ‘Stranger Things’ – Houston Chronicle

    Step Inside Netflix’s New Dallas Immersive Experience Featuring Hits Like ‘Squid Game’ and ‘Stranger Things

    ‘Puttin’ on the Ritz’: Civic Players bring ‘Young Frankenstein’ to life – Yahoo

    Civic Players Deliver a Hilarious and Unforgettable Performance of ‘Young Frankenstein

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Owls inspire new revolutionary noise reduction technology – KTEN

    Owls inspire new revolutionary noise reduction technology – KTEN

    New center coming to Mizzou will focus on energy research and technology – Columbia Missourian

    Mizzou Launches Innovative New Center Dedicated to Energy Research and Technology

    Mirrors in space and underwater curtains: can technology buy us enough time to save the Arctic ice caps? – The Guardian

    Can Technology Like Space Mirrors and Underwater Curtains Buy Us Time to Save the Arctic Ice Caps?

    Naples restaurant owner prepares for hurricane season with new flood technology – Fox4Now.com

    Naples restaurant owner prepares for hurricane season with new flood technology – Fox4Now.com

    Emerging Memory and Storage Technology Market Analysis Report 2025-2034 | AI and HPC Boom Fuels Surging Demand for Fast, Low-Power Memory Devices – Yahoo Finance

    How AI and HPC Are Driving Explosive Growth in Fast, Low-Power Memory Technologies Through 2034

    Ostin Technology (OST): Volatility’s Warning or Contrarian Opportunity? – AInvest

    Ostin Technology (OST): Navigating Market Volatility – Red Flag or Hidden Opportunity?

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

GitHub fixes race condition that could have led to ‘repojacking’

September 18, 2023
in Technology
GitHub fixes race condition that could have led to ‘repojacking’
Share on FacebookShare on Twitter

Jürgen Fälchle – stock.adobe.c

A subtle flaw in how GitHub handled repository creation and user renaming could have had serious consequences for the open source community, but has now been fixed. Learn more about how it worked

Alex Scroxton

By

Alex Scroxton,
Security Editor

Published: 13 Sep 2023 16:00

GitHub has fixed a race condition vulnerability in its repository creation and user renaming operations that could have enabled threat actors to perform what is known as a repojacking attack.

Discovered and disclosed by researchers from Checkmarx, had the flaw been exploited, it could have been used to take control of code repositories and hijack them to distribute malicious code. It would also have had bad implications for the reputations of those who fell victim to it.

“Repojacking is a technique where an attacker takes control of a GitHub repository by exploiting a logical flaw that renders renamed users vulnerable,” wrote Elad Rapoport of Checkmarx.

“The attacker hijacks a legitimate, often popular, namespace on GitHub. A namespace is the combination of the username and repo name, for example: example-user/example-repo.”

Namespaces on GitHub become vulnerable to repojacking when the original username is changed using the “user rename” feature. When a GitHub user renames themselves, GitHub does not set up redirects for their old profile page or Pages sites, but does create redirects for their repositories. Users are made aware of this via a pop-up during the process.

Unfortunately, in doing so, the old username also becomes available for anybody else to claim, so once the user has been successfully renamed, a malicious actor can claim their old username, open a repo under the matching repo name, and hijack the namespace.

Other flaws in this process have previously been identified and fixed, and GitHub did have protection measures available – notably retiring popular repositories (those with more than 100 clones at the time of renaming) so that the username couldn’t be taken.

However, Rapoport found he was able to bypass these fixes by taking advantage of a race condition between the creation of a repository and the renaming of a username, by almost simultaneously doing both – using an API request for repository creation and a renamed request interception for the username change.

“Successful exploitation enables the takeover of popular code packages in several package managers, including ‘Packagist,’ ‘Go,’ ‘Swift’ and more,” he said. “We have identified over 4,000 packages in those package managers using renamed usernames and are at risk of being vulnerable to this technique in case a new bypass is found. Of these packages at risk, hundreds of them have garnered over 1,000 stars on GitHub.

“In addition, exploiting this bypass can also result in a takeover of popular GitHub actions, which are also consumed by specifying a GitHub namespace. Poisoning a popular GitHub action could lead to major supply chain attacks with significant repercussions.”

Although this repojacking issue has been fixed, it is the fourth one found in the past couple of years – three in 2022 alone – and Rapoport said it spoke to persistent risks associated with the popular repository namespace retirement mechanism.

“Many GitHub users, including users that control popular repositories and packages, choose to use the ‘user rename’ feature GitHub offers,” he said. “For that reason, the attempt to bypass the ‘popular repository namespace retirement’ remains an attractive attack point for supply chain attackers with the potential to cause substantial damages.”

In spite of the fix, Checkmarx is recommending that users avoid using retired namespaces to minimise their attack surface, and make sure there are no code dependencies that may leave a GitHub repository vulnerable. It offers its own open source tool, Chainjacking, which can assist with this.

Read more on Web application security


Create a GitHub Personal Access Token example

CameronMcKenzie

By: Cameron McKenzie


Git commit config and credential confusion causes consternation for customers

CameronMcKenzie

By: Cameron McKenzie


Follow this Harness IO tutorial to get started with CI/CD

MichaelLevan

By: Michael Levan


Quick GitHub ‘Permission denied (publickey)’ SSH error fix

CameronMcKenzie

By: Cameron McKenzie

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : Computer Weekly – https://www.computerweekly.com/news/366552015/GitHub-fixes-race-condition-that-could-have-led-to-repojacking

Tags: fixesGitHubtechnology
Previous Post

BianLian ransomware gang holds Save the Children hostage

Next Post

GCHQ breached privacy rights of IT professional and security researcher, human rights court rules

These 9 towns were named the ‘quirkiest’ in New Jersey, according to World Atlas – Bergen Record

These 9 towns were named the ‘quirkiest’ in New Jersey, according to World Atlas – Bergen Record

July 1, 2025
Trump’s Tax Bill Won’t Help or Hurt the Economy. The Deficit Is Already Huge. – Barron’s

Trump’s Tax Bill Won’t Help or Hurt the Economy. The Deficit Is Already Huge. – Barron’s

July 1, 2025
Nantucket Dance Festival opens July 8 – The Inquirer and Mirror

Nantucket Dance Festival Launches with Thrilling Performances Beginning July 8

July 1, 2025
Who would be affected by health care cuts in Senate version of Trump’s budget bill – PBS

Who Will Be Hit Hardest by Health Care Cuts in the Senate’s Trump Budget Plan?

July 1, 2025
Senate passes Trump’s reconciliation bill with Vance casting tie-breaking vote – PBS

Senate Passes Trump’s Reconciliation Bill After Vance Casts Decisive Tie-Breaking Vote

July 1, 2025
Groundbreaking technology to help police tackle violence against women – The Independent

Revolutionary Technology Transforms the Fight Against Violence Toward Women

July 1, 2025
Apple Inc. (AAPL) Adds Tennis To Its List of Supported Sports Ahead of Wimbledon – Yahoo Finance

Apple Inc. (AAPL) Adds Tennis To Its List of Supported Sports Ahead of Wimbledon – Yahoo Finance

July 1, 2025
Nature’s headlamps: A unique light-focusing structure in Parasesarma de Man, 1895 mangrove crabs – ESA Journals

Nature’s headlamps: A unique light-focusing structure in Parasesarma de Man, 1895 mangrove crabs – ESA Journals

July 1, 2025
Scientists found what just might be Earth’s oldest rocks – Boy Genius Report

Scientists found what just might be Earth’s oldest rocks – Boy Genius Report

July 1, 2025
The EU must show leadership and stand up for science, health and women’s rights – The Parliament Magazine

Why the EU Needs to Take the Lead in Protecting Science, Health, and Women’s Rights

July 1, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (701)
  • Economy (726)
  • Entertainment (21,615)
  • General (15,655)
  • Health (9,766)
  • Lifestyle (731)
  • News (22,149)
  • People (726)
  • Politics (733)
  • Science (15,943)
  • Sports (21,223)
  • Technology (15,710)
  • World (707)

Recent News

These 9 towns were named the ‘quirkiest’ in New Jersey, according to World Atlas – Bergen Record

These 9 towns were named the ‘quirkiest’ in New Jersey, according to World Atlas – Bergen Record

July 1, 2025
Trump’s Tax Bill Won’t Help or Hurt the Economy. The Deficit Is Already Huge. – Barron’s

Trump’s Tax Bill Won’t Help or Hurt the Economy. The Deficit Is Already Huge. – Barron’s

July 1, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version