Deployment hook issues when using git (CVE-2022-24765)

Incident Report for Skaylink Managed AWS Hosting Platform

Resolved

This incident has been resolved.

Posted Apr 14, 2022 - 19:05 CEST

Monitoring

We have determined a process to mitigate this behaviour. You can find the required steps in our FAQ [1].

[1] https://root360.atlassian.net/wiki/spaces/KB/pages/2014352844/Using+deployment+hooks#Git

Posted Apr 14, 2022 - 12:31 CEST

Identified

Due to a security update for git to fix CVE-2022-24765, deployments which are using pre-/post-hooks within a git repository may fail with the following error:

```
fatal: unsafe repository ('/srv/...' is owned by someone else)
To add an exception for this directory, call:

git config --global --add safe.directory /srv/...
```

We are looking into possible solutions which are not degrading security on the affected systems.

Posted Apr 14, 2022 - 11:52 CEST

This incident affected: r3 suite.