FEDORA-2018-d5139c4fd6 created by tmz 2 years ago for Fedora 27
stable

Upstream security update resolving an issue with git clone --recurse-submodules.

From the upstream release announcement:

These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone", the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can be used to detect such malicious repository content when fetching or accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen and Jeff King, respectively.

How to install

sudo dnf upgrade --advisory=FEDORA-2018-d5139c4fd6

This update has been submitted for testing by tmz.

2 years ago

tmz edited this update.

2 years ago

This update has been pushed to testing.

2 years ago
User Icon filiperosset commented & provided feedback 2 years ago
karma

no regressions noted

User Icon cserpentis commented & provided feedback 2 years ago
karma

works for me in a VM

User Icon pwalter commented & provided feedback 2 years ago
karma

Works

User Icon jonathancalloway commented & provided feedback 2 years ago
karma

No regressions noted

This update has been submitted for batched by bodhi.

2 years ago

This update has been submitted for stable by bodhi.

2 years ago

This update has been pushed to stable.

2 years ago

Please login to add feedback.

Metadata
Type
security
Severity
medium
Karma
4
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-2
Stable by Karma
4
Stable by Time
disabled
Dates
submitted
2 years ago
in testing
2 years ago
in stable
2 years ago
modified
2 years ago
BZ#1636619 CVE-2018-17456 git: arbitrary code execution via .gitmodules
0
0
BZ#1636620 CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]
0
0

Automated Test Results