Git Users Should Get To Updating Due To An Arbitrary Code Execution Vulnerability
Written by Michael Larabel in Linux Security on 5 October 2018 at 01:53 PM EDT. 19 Comments
Git maintainer Junio Hamano issued new versions of this widely-used version control system today going back to the Git 2.14 release series in order to address a new security vulnerability.

This latest Git vulnerability is CVE-2018-17456 and allows for an attacker to execute arbitrary code. This arbitrary code execution can be achieved via modifying the .gitmodules file in a project being cloned through a --recurse-submodules call.

Hamano explained, "When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone"."

Additional information as well as a second security issue are outlined in this release announcement for Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1 and 2.19.1.
Related News
About The Author
Author picture

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter or contacted via

Popular News This Week