Git Issues Batch Of New Releases To Fix Security Issues
Written by Michael Larabel in Linux Security on 29 May 2018 at 01:26 PM EDT. 5 Comments
LINUX SECURITY --
Git 2.13.7, 2.14.4, 2.15.2, 2.16.4, and 2.17.1 were all released today in order to fix two new CVE security disclosures.

The most prominent issue resolved is CVE-2018-11235 and comes down to the untrusted .gitmodules file blindly accepting submodule "names" to append to the on-disk repository paths. If inserting relative paths outside of the directory using ../, data on the system could be unknowingly compromised. Git is now protected against the possibility of malicious names being introduced to the Git modules file.

The other security fix is CVE-2018-11233 that could lead to reading random pieces of memory when running on an NTFS file-system.

These fixes are now in place along with support for Git on the server-side to reject pushes to repositories that attempt to create problematic Git modules name data. This extra addition can help prevent malicious Git repositories from spreading via code hosting sites.

The brief release announcement on the new versions of Git via the release announcement.
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Linux Security News
Popular News This Week