Critical Vulnerability in Git Package: Recursive Clone Exploit
Summary
ALPINE-CVE-2019-1387: An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Affects git versions < 2.22.2-r0. Fixed in 2.22.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, flexibility, and support for non-linear development workflows. However, certain versions of Git are vulnerable to a security flaw that permits remote code execution through recursive clones, posing a significant risk to users who rely on this functionality.
Vulnerability Detail
An issue was found in Git versions prior to v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The vulnerability arises from insufficient validation of submodule names during recursive cloning. This weakness allows attackers to execute arbitrary code on a victim's machine by crafting malicious submodule URLs, leading to potential data breaches and system compromises.
How To Fix
Minimum fixed version
2.22.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using recursive clones or ensure that submodule URLs are from trusted sources. Additionally, disabling submodule updates during clone operations can help mitigate the risk until the package is updated.
Conclusion
The vulnerability in Git related to recursive clones poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the latest patched version to safeguard their systems. Utilizing tools like Vulert can enhance your ability to monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for git →
FAQ
A recursive clone in Git is a process where a repository is cloned along with its submodules, which are separate repositories linked to the main repository.
You can check your Git version by running 'git --version' in your terminal. If it is below 2.24.1, it is vulnerable.
Failing to address this vulnerability could lead to unauthorized code execution, data loss, and potential breaches of sensitive information.
Yes, Vulert can monitor your projects for open-source vulnerabilities using just a manifest file, alerting you in real-time.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
