The latest iteration of the Git 2.17.1 which was released on May 28th contained fixes for the vulnerabilities for CVE-2018-11233 and CVE-2018-11235 which can lead to the Remote Code Execution on the Server.
“The problem is that when you git clone a repository, there is some important configuration that you don’t get from the server,” Edward Thomson, program manager for Visual Studio Team Services at Microsoft, explained in a blog post. “This includes the contents of the .git/config file, and things like hooks, which are scripts that will be run at certain points within the git workflow. For example, the post-checkout hook will be run anytime git checks files out into the working directory.
The configuration of the git folder is cloned from the remote server which would cause a dangerous vulnerability that a remote server could provide which leads to the execution of the code. Thomson said that “Unfortunately, with this submodule configuration vulnerability, that’s exactly what happens. Since the submodule’s repository is checked in to the parent repository, it’s never actually cloned. The submodule repository can therefore actually have a hook already configured.”
Thomson is currently advising the users to update their Git clients to the latest version. The patch has also been backported for Git version 2.13.7, 2.14.4, 2.15.2 and 2.16.4. At present, the Git hosting servers include GitHub, GitLab, Visual Studio Team Services and Heroku. There is also another vulnerability that allows the attackers to trick the code that sanity-checks paths on NTFS to read random and the pieces of the memory.
Take your time to comment on this article.
