CVE-2018-11235: Path Traversal
A flaw was found in git which allows arbitrary code to be executed when running 'git clone --recurse-submodules (or the deprecated 'git clone --recursive' synonym). A malicious repository can include a .gitmodules submodule config file which points outside of the repository. When git clones such a repository it can be tricked into running hooks within the cloned submodule, which is under the control of the attacker.
References: https://public-inbox.org/git/xmqqy3g2flb6.fsf@gitster-ct.c.googlers.com/ https://www.edwardthomson.com/blog/upgradinggitforcve201811235.html https://news.ycombinator.com/item?id=17181238
Other sources
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GITDIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-11235?
CVE-2018-11235 is a vulnerability in Git versions before 2.17.1 that allows remote code execution.
How severe is CVE-2018-11235?
CVE-2018-11235 has a severity rating of 7.8, which is categorized as high.
Which versions of Git are affected by CVE-2018-11235?
Git versions before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1 are affected by CVE-2018-11235.
How can I fix CVE-2018-11235?
To fix CVE-2018-11235, you should update Git to version 2.17.1 or later.
Where can I find more information about CVE-2018-11235?
You can find more information about CVE-2018-11235 at the following references: [http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html](http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html), [http://www.securityfocus.com/bid/104345](http://www.securityfocus.com/bid/104345), [http://www.securitytracker.com/id/1040991](http://www.securitytracker.com/id/1040991).