CVE-2018-17456

Name of the Vulnerable Software and Affected Versions Git versions 2.14.5 and earlier, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, 2.19.x before 2.19.1

Description The issue is related to the incorrect handling of the recursive git clone task applied to a superproject, where the .gitmodules file has a URL field starting with a '-' character. This can allow a remote attacker to execute arbitrary code.

Recommendations For Git versions 2.14.5 and earlier, update to version 2.14.5 or later. For Git versions 2.15.x before 2.15.3, update to version 2.15.3 or later. For Git versions 2.16.x before 2.16.5, update to version 2.16.5 or later. For Git versions 2.17.x before 2.17.2, update to version 2.17.2 or later. For Git versions 2.18.x before 2.18.1, update to version 2.18.1 or later. For Git versions 2.19.x before 2.19.1, update to version 2.19.1 or later.