CVE-2018-11235

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.13.7 Git versions 2.14.x prior to 2.14.4 Git versions 2.15.x prior to 2.15.2 Git versions 2.16.x prior to 2.16.4 Git versions 2.17.x prior to 2.17.1

Description The issue is related to errors in processing specially formed submodule names in the .gitmodules file. This can allow a remote attacker to execute arbitrary code. The vulnerability can be exploited when a malicious project with a crafted .gitmodules file is cloned using "git clone --recurse-submodules", leading to directory traversal and the execution of post-checkout hooks from a submodule.

Recommendations For Git versions prior to 2.13.7, update to version 2.13.7 or later. For Git versions 2.14.x prior to 2.14.4, update to version 2.14.4 or later. For Git versions 2.15.x prior to 2.15.2, update to version 2.15.2 or later. For Git versions 2.16.x prior to 2.16.4, update to version 2.16.4 or later. For Git versions 2.17.x prior to 2.17.1, update to version 2.17.1 or later. As a temporary workaround, consider avoiding the use of "git clone --recurse-submodules" until a patch is applied.