Brew Github

Posted on |



  • 🚀 Homebrew's GitHub Actions homebrew actions JavaScript BSD-2-Clause 15 38 0 1 Updated Apr 16, 2021.github.
  • Install homebrew on wsl. GitHub Gist: instantly share code, notes, and snippets.

Have your own recipe? Just propose it in issues! Want to contribute? Welcome to the repository: github.com/2brew/2brew.github.io.

On 18th April 2021, a security researcher identified a vulnerability in our review-cask-pr GitHub Action used on the homebrew-cask and all homebrew-cask-* taps (non-default repositories) in the Homebrew organization and reported it on our HackerOne.

Whenever an affected cask tap received a pull request to change only the version of a cask, the review-cask-pr GitHub Action would automatically review and approve the pull request. The approval would then trigger the automerge GitHub Action which would merge the approved pull request. A proof-of-concept (PoC) pull request demonstrating the vulnerability was submitted with our permission. Mac os catalina next update. We subsequently reverted the PoC pull request, disabled and removed the automerge GitHub Action and disabled and removed the review-cask-pr GitHub Action from all vulnerable repositories.

What was impacted

The discovered vulnerability would allow an attacker to inject arbitrary code into a cask and have it be merged automatically. This is due to a flaw in the git_diff dependency of the review-cask-pr GitHub Action, which is used to parse a pull request’s diff for inspection. Due to this flaw, the parser can be spoofed into completely ignoring the offending lines, resulting in successfully approving a malicious pull request.

Notepad++ download for macbook pro. A single cask was compromised with a harmless change for the duration of the demonstration pull request until its reversal. No action is required by users due to this incident.

What we’re doing about it

Brew Github
  • The vulnerable review-cask-pr GitHub Action has been disabled and removed from all repositories.
  • The automerge GitHub Action has been disabled and removed from all repositories (in favour of the GitHub built-in functionality that did not exist when this action was created).
  • We have removed the ability for our bots to commit to homebrew/cask* repositories.
  • All homebrew/cask* pull requests will require a manual review and approval by a maintainer.
  • We are improving documentation to help onboard new homebrew/cask maintainers and trainingexisting homebrew/core maintainers to help with homebrew/cask.
Homebrew github packages

We did, do and will continue to take the security of the project and our users very seriously. We try our best to behave as a for-profit company would do in terms of timely response to security issues.

In order to ensure and improve Homebrew’s security, please consider contributing your code and code reviews to our GitHub projects.

Brew Github Wiki

Brew Github

Homebrew Github

Brew Github

Homebrew Github Actions

Thanks for using Homebrew!