Git Issues Batch Of New Releases To Fix Security Issues

Written by Michael Larabel in Linux Security on 29 May 2018 at 01:26 PM EDT. 5 Comments
Git 2.13.7, 2.14.4, 2.15.2, 2.16.4, and 2.17.1 were all released today in order to fix two new CVE security disclosures.

The most prominent issue resolved is CVE-2018-11235 and comes down to the untrusted .gitmodules file blindly accepting submodule "names" to append to the on-disk repository paths. If inserting relative paths outside of the directory using ../, data on the system could be unknowingly compromised. Git is now protected against the possibility of malicious names being introduced to the Git modules file.

The other security fix is CVE-2018-11233 that could lead to reading random pieces of memory when running on an NTFS file-system.

These fixes are now in place along with support for Git on the server-side to reject pushes to repositories that attempt to create problematic Git modules name data. This extra addition can help prevent malicious Git repositories from spreading via code hosting sites.

The brief release announcement on the new versions of Git via the release announcement.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week