FEDORA-2018-06090dff59 created by tmz 2 years ago for Fedora 29
stable

Upstream security update resolving an issue with git clone --recurse-submodules.

From the upstream release announcement:

These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone", the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can be used to detect such malicious repository content when fetching or accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen and Jeff King, respectively.

How to install

sudo dnf upgrade --advisory=FEDORA-2018-06090dff59

This update has been submitted for testing by tmz.

2 years ago

tmz edited this update.

2 years ago
User Icon sedrubal commented & provided feedback 2 years ago
karma

Works for me and git won't try to execute malicious submodule urls any more but prints a meaningful message.

BZ#1636619 CVE-2018-17456 git: arbitrary code execution via .gitmodules
BZ#1636620 CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]

This update has been pushed to testing.

2 years ago
User Icon pwalter commented & provided feedback 2 years ago
karma

Works

User Icon pbrobinson commented & provided feedback 2 years ago
karma

Seems fine with basic push/pull/commit/clone

BZ#1636619 CVE-2018-17456 git: arbitrary code execution via .gitmodules
BZ#1636620 CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]
User Icon cairo provided feedback 2 years ago
karma

This update has been submitted for batched by bodhi.

2 years ago

This update has been submitted for stable by pwalter.

2 years ago

This update has been pushed to stable.

2 years ago
User Icon nomos commented & provided feedback 2 years ago
karma

Works as expected.


Please login to add feedback.

Metadata
Type
security
Severity
medium
Karma
5
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-2
Stable by Karma
4
Stable by Time
disabled
Dates
submitted
2 years ago
in testing
2 years ago
in stable
2 years ago
modified
2 years ago
BZ#1636619 CVE-2018-17456 git: arbitrary code execution via .gitmodules
0
2
BZ#1636620 CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]
0
2

Automated Test Results