Git Users Should Get To Updating Due To An Arbitrary Code Execution Vulnerability
Written by Michael Larabel in Security on 5 October 2018 at 01:53 PM EDT. 19 Comments
SECURITY --
Git maintainer Junio Hamano issued new versions of this widely-used version control system today going back to the Git 2.14 release series in order to address a new security vulnerability.

This latest Git vulnerability is CVE-2018-17456 and allows for an attacker to execute arbitrary code. This arbitrary code execution can be achieved via modifying the .gitmodules file in a project being cloned through a --recurse-submodules call.

Hamano explained, "When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone"."

Additional information as well as a second security issue are outlined in this release announcement for Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1 and 2.19.1.

About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Security News
Popular News This Week