Opened 3 years ago

Closed 3 years ago

#11217 closed enhancement (fixed)

git-2.19.1 (Security update)

Reported by: Douglas R. Reno Owned by: Douglas R. Reno
Priority: highest Milestone: 8.4
Component: BOOK Version: SVN
Severity: normal Keywords:


New point version

Git v2.19.1 Release Notes

This release merges up the fixes that appear in v2.14.5 and in
v2.17.2 to address the recently reported CVE-2018-17456; see the
release notes for those versions for details.

Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1

These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess.  If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option.  This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to detect such malicious repository content when fetching or
accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen
and Jeff King, respectively.


Marking as a highest priority vulnerability since a known-working exploit is out in the wild (I have a copy, but I'm not sharing it).

Change History (4)

comment:1 by Douglas R. Reno, 3 years ago

Owner: changed from blfs-book to Douglas R. Reno
Status: newassigned

comment:2 by Douglas R. Reno, 3 years ago

Summary: git-2.19.1 (Security update)git-2.18.1 (Security update)

comment:3 by Douglas R. Reno, 3 years ago

Summary: git-2.18.1 (Security update)git-2.19.1 (Security update)

comment:4 by Douglas R. Reno, 3 years ago

Resolution: fixed
Status: assignedclosed

Fixed at r20586

Note: See TracTickets for help on using tickets.