Critical Memory Leak Vulnerability in Git Package
Summary
ALPINE-CVE-2018-11233: In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory. Affects git versions < 2.17.1-r0. Fixed in 2.17.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, efficiency, and support for non-linear development workflows. However, certain versions of Git are vulnerable to a memory leak issue that can lead to unauthorized access to sensitive data on NTFS file systems.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11233, affects Git versions prior to 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1. It originates from insufficient checks on pathnames when interacting with NTFS file systems, which can result in reading out-of-bounds memory. This could potentially expose sensitive information and compromise the integrity of the system, making it a significant security risk.
How To Fix
Minimum fixed version
2.17.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Git on NTFS file systems until the package is updated. This may involve switching to a different file system or using a virtual machine with a different operating system.
Conclusion
The CVE-2018-11233 vulnerability in Git poses a significant risk to users operating on NTFS file systems. It is crucial to update to the patched version to mitigate potential security threats. Users should remain vigilant and consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for git →
FAQ
CVE-2018-11233 is a vulnerability in Git that allows for potential memory leaks and unauthorized access to sensitive data on NTFS file systems.
Affected versions include Git versions prior to 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-11233 is 7.5, indicating a high severity level.
If an immediate update is not possible, consider using a different file system or temporarily avoiding Git operations on NTFS until the vulnerability is patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
