Git Users Should Get To Updating Due To An Arbitrary Code Execution Vulnerability

Git maintainer Junio Hamano issued new versions of this widely-used version control system today going back to the Git 2.14 release series in order to address a new security vulnerability.

This latest Git vulnerability is CVE-2018-17456 and allows for an attacker to execute arbitrary code. This arbitrary code execution can be achieved via modifying the .gitmodules file in a project being cloned through a --recurse-submodules call.

Hamano explained, "When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone"."

Additional information as well as a second security issue are outlined in this release announcement for Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1 and 2.19.1.