Git Issues Batch Of New Releases To Fix Security Issues

Git 2.13.7, 2.14.4, 2.15.2, 2.16.4, and 2.17.1 were all released today in order to fix two new CVE security disclosures.

The most prominent issue resolved is CVE-2018-11235 and comes down to the untrusted .gitmodules file blindly accepting submodule "names" to append to the on-disk repository paths. If inserting relative paths outside of the directory using ../, data on the system could be unknowingly compromised. Git is now protected against the possibility of malicious names being introduced to the Git modules file.

The other security fix is CVE-2018-11233 that could lead to reading random pieces of memory when running on an NTFS file-system.

These fixes are now in place along with support for Git on the server-side to reject pushes to repositories that attempt to create problematic Git modules name data. This extra addition can help prevent malicious Git repositories from spreading via code hosting sites.

The brief release announcement on the new versions of Git via the release announcement.