A flaw was found in the way the Git client handles "ssh://" URLs. A maliciously crafted "ssh://" URL would cause Git clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious users committing to an honest server (to attack another user of that server's repositories), or by a proxy server.

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

A flaw was found in git which allows an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules.

References: https://bugzilla.novell.com/showbug.cgi?id=1110949 https://groups.google.com/forum/#!topic/git-packagers/fNLXf6LQC08

A flaw was found in git which allows arbitrary code to be executed when running 'git clone --recurse-submodules (or the deprecated 'git clone --recursive' synonym). A malicious repository can include a .gitmodules submodule config file which points outside of the repository. When git clones such a repository it can be tricked into running hooks within the cloned submodule, which is under the control of the attacker.

References: https://public-inbox.org/git/xmqqy3g2flb6.fsf@gitster-ct.c.googlers.com/ https://www.edwardthomson.com/blog/upgradinggitforcve201811235.html https://news.ycombinator.com/item?id=17181238

Git before versions 2.13.7, 2.14.4, 2.15.2, 2.16.4 and 2.17.1 performs path sanity-checks in isntfsdotgit():path.c that can be fooled into reading arbitrary memory.

Upstream announcement: https://marc.info/?l=git&m=152761328506724&w=2