{"thread":{"id":"49493","subject":"[Announce] Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1","startedAt":"2018-10-05T17:01:26Z","lastAt":"2018-10-05T17:04:13Z","messageCount":2,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"359707","messageId":"xmqqy3bcuy3l.fsf@gitster-ct.c.googlers.com","threadId":"49493","inReplyTo":null,"subject":"[Announce] Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2018-10-05T17:01:18Z","receivedAt":"2018-10-05T17:01:26Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"These releases fix a security flaw (CVE-2018-17456), which allowed an\nattacker to execute arbitrary code by crafting a malicious .gitmodules\nfile in a project cloned with --recurse-submodules.\n\nWhen running \"git clone --recurse-submodules\", Git parses the supplied\n.gitmodules file for a URL field and blindly passes it as an argument\nto a \"git clone\" subprocess.  If the URL field is set to a string that\nbegins with a dash, this \"git clone\" subprocess interprets the URL as\nan option.  This can lead to executing an arbitrary script shipped in\nthe superproject as the user who ran \"git clone\".\n\nIn addition to fixing the security issue for the user running \"clone\",\nthe 2.17.2, 2.18.1 and 2.19.1 releases have an \"fsck\" check which can\nbe used to detect such malicious repository content when fetching or\naccepting a push. See \"transfer.fsckObjects\" in git-config(1).\n\nCredit for finding and fixing this vulnerability goes to joernchen\nand Jeff King, respectively.\n\nP.S. Folks at Microsoft tried to follow the known exploit recipe on\nGit for Windows (but not Cygwin or other Git implementations on\nWindows) and found that the recipe (or its variants they can think\nof) would not make their system vulnerable.  This is due to the fact\nthat the type of submodule path require by the known exploit recipe\ncannot be created on Windows.  Nonetheless, it is possible we have\nmissed some exploitation path and users are encouraged to upgrade.\n"},{"id":"359708","messageId":"xmqqpnwouxz1.fsf@gitster-ct.c.googlers.com","threadId":"49493","inReplyTo":"xmqqy3bcuy3l.fsf@gitster-ct.c.googlers.com","subject":"Re: [Announce] Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2018-10-05T17:04:02Z","receivedAt":"2018-10-05T17:04:13Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n> These releases fix a security flaw (CVE-2018-17456), which allowed an\n> attacker to execute arbitrary code by crafting a malicious .gitmodules\n> file in a project cloned with --recurse-submodules.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of these\ntags:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n"}]}