==================================================================== CERT-Renater Note d'Information No. 2018/VULN322 _____________________________________________________________________ DATE : 08/10/2018 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): systems running Git versions prior to 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, 2.19.1. ===================================================================== https://public-inbox.org/git/xmqqpnwouxz1.fsf@gitster-ct.c.googlers.com/T/#t _____________________________________________________________________ [Announce] Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 @ 2018-10-05 17:01 Junio C Hamano 2018-10-05 17:04 ` Junio C Hamano 0 siblings, 1 reply; 2+ messages in thread From: Junio C Hamano @ 2018-10-05 17:01 UTC (permalink / raw) To: git; +Cc: Linux Kernel, git-packagers These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone". In addition to fixing the security issue for the user running "clone", the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can be used to detect such malicious repository content when fetching or accepting a push. See "transfer.fsckObjects" in git-config(1). Credit for finding and fixing this vulnerability goes to joernchen and Jeff King, respectively. P.S. Folks at Microsoft tried to follow the known exploit recipe on Git for Windows (but not Cygwin or other Git implementations on Windows) and found that the recipe (or its variants they can think of) would not make their system vulnerable. This is due to the fact that the type of submodule path require by the known exploit recipe cannot be created on Windows. Nonetheless, it is possible we have missed some exploitation path and users are encouraged to upgrade. ^ permalink raw reply [flat|nested] 2+ messages in thread * Re: [Announce] Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 2018-10-05 17:01 [Announce] Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 Junio C Hamano @ 2018-10-05 17:04 ` Junio C Hamano 0 siblings, 0 replies; 2+ messages in thread From: Junio C Hamano @ 2018-10-05 17:04 UTC (permalink / raw) To: git; +Cc: Linux Kernel, git-packagers Junio C Hamano writes: > These releases fix a security flaw (CVE-2018-17456), which allowed an > attacker to execute arbitrary code by crafting a malicious .gitmodules > file in a project cloned with --recurse-submodules. The tarballs are found at: https://www.kernel.org/pub/software/scm/git/ The following public repositories all have a copy of these tags: url = https://kernel.googlesource.com/pub/scm/git/git url = git://repo.or.cz/alt-git.git url = https://github.com/gitster/git ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================