Critical Remote Code Execution Vulnerability in Git Package
Summary
ALPINE-CVE-2018-17456: Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproj... Affects git versions < 2.19.1-r0. Fixed in 2.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed version control system widely used for source code management in software development. It allows multiple developers to work on a project simultaneously, tracking changes and facilitating collaboration. The Git package is essential for managing repositories and handling versioning. However, it has been found to be vulnerable to a specific issue that can lead to remote code execution during the cloning of repositories, particularly when handling malicious .gitmodules files.
Vulnerability Detail
The vulnerability, identified as CVE-2018-17456, affects Git versions prior to 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1. It allows an attacker to execute arbitrary code on a victim's machine when they perform a recursive 'git clone' of a superproject that contains a .gitmodules file with a URL field starting with a '-' character. This can lead to severe security implications, including unauthorized access and control over the affected system.
How To Fix
Minimum fixed version
2.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using 'git clone' on repositories that you do not trust, especially those with a .gitmodules file that may contain malicious URLs. Always review the contents of .gitmodules files before executing clone commands.
Conclusion
The CVE-2018-17456 vulnerability in Git poses a significant risk of remote code execution through malicious .gitmodules files. Users are advised to update their Git installations to the latest patched versions to mitigate this risk. Additionally, employing best practices when cloning repositories can further enhance security.
See every vulnerability recorded for git →
FAQ
CVE-2018-17456 is a critical vulnerability in Git that allows remote code execution when processing a malicious .gitmodules file during a recursive clone.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Affected versions include Git versions before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Regularly update your Git installation to the latest version and review any third-party repositories before cloning them.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
