diff --git a/SOURCES/git-cve-2020-5260.patch b/SOURCES/git-cve-2020-5260.patch
new file mode 100644
index 0000000..20d60b7
--- /dev/null
+++ b/SOURCES/git-cve-2020-5260.patch
@@ -0,0 +1,201 @@
+diff -ur b/credential.c a/credential.c
+--- b/credential.c	2020-04-09 09:53:10.568938942 +0200
++++ a/credential.c	2020-04-09 12:34:56.735418779 +0200
+@@ -195,6 +195,8 @@
+ {
+ 	if (!value)
+ 		return;
++	if (strchr(value, '\n'))
++		die("credential value for %s contains newline", key);
+ 	fprintf(fp, "%s=%s\n", key, value);
+ }
+ 
+@@ -321,8 +323,21 @@
+ 	FREE_AND_NULL(c->password);
+ 	c->approved = 0;
+ }
+-
+-void credential_from_url(struct credential *c, const char *url)
++static int check_url_component(const char *url, int quiet,
++				const char *name, const char *value)
++{
++	if (!value)
++		return 0;
++	if (!strchr(value, '\n'))
++		return 0;
++
++	if (!quiet)
++		warning(_("url contains a newline in its %s component: %s"),
++			name, url);
++    return -1;
++}
++int credential_from_url_gently(struct credential *c, const char *url,
++				int quiet)
+ {
+ 	const char *at, *colon, *cp, *slash, *host, *proto_end;
+ 
+@@ -336,7 +351,7 @@
+ 	 */
+ 	proto_end = strstr(url, "://");
+ 	if (!proto_end)
+-		return;
++		return 0;
+ 	cp = proto_end + 3;
+ 	at = strchr(cp, '@');
+ 	colon = strchr(cp, ':');
+@@ -371,4 +386,21 @@
+ 		while (p > c->path && *p == '/')
+ 			*p-- = '\0';
+ 	}
++
++    if (check_url_component(url, quiet, "username", c->username) < 0 ||
++            check_url_component(url, quiet, "password", c->password) < 0 ||
++            check_url_component(url, quiet, "protocol", c->protocol) < 0 ||
++            check_url_component(url, quiet, "host", c->host) < 0 ||
++            check_url_component(url, quiet, "path", c->path) < 0)
++        return -1;
++
++    return 0;
++}
++
++void credential_from_url(struct credential *c, const char *url)
++{
++    if (credential_from_url_gently(c, url, 0) < 0) {
++        warning(_("skipping credential lookup for url: %s"), url);
++        credential_clear(c);
++    }
+ }
+diff -ur b/credential.h a/credential.h
+--- b/credential.h	2020-04-09 09:53:10.568938942 +0200
++++ a/credential.h	2020-04-09 10:06:07.467159059 +0200
+@@ -28,7 +28,23 @@
+ 
+ int credential_read(struct credential *, FILE *);
+ void credential_write(const struct credential *, FILE *);
++
++/*
++ * Parse a url into a credential struct, replacing any existing contents.
++ *
++ * Ifthe url can't be parsed (e.g., a missing "proto://" component), the
++ * resulting credential will be empty but we'll still return success from the
++ * "gently" form.
++ *
++ * If we encounter a component which cannot be represented as a credential
++ * value (e.g., because it contains a newline), the "gently" form will return
++ * an error but leave the broken state in the credential object for further
++ * examination.  The non-gentle form will issue a warning to stderr and return
++ * an empty credential.
++*/
+ void credential_from_url(struct credential *, const char *url);
++int credential_from_url_gently(struct credential *, const char *url, int quiet);
++
+ int credential_match(const struct credential *have,
+ 		     const struct credential *want);
+ 
+diff -ur b/fsck.c a/fsck.c
+--- b/fsck.c	2020-04-09 09:53:10.569938954 +0200
++++ a/fsck.c	2020-04-09 12:29:42.713615414 +0200
+@@ -14,6 +14,7 @@
+ #include "packfile.h"
+ #include "submodule-config.h"
+ #include "config.h"
++#include "credential.h"
+ 
+ static struct oidset gitmodules_found = OIDSET_INIT;
+ static struct oidset gitmodules_done = OIDSET_INIT;
+@@ -945,6 +946,19 @@
+ 	return fsck_tag_buffer(tag, data, size, options);
+ }
+ 
++static int check_submodule_url(const char *url)
++{
++	struct credential c = CREDENTIAL_INIT;
++	int ret;
++
++	if (looks_like_command_line_option(url))
++		return -1;
++
++	ret = credential_from_url_gently(&c, url, 1);
++	credential_clear(&c);
++	return ret;
++}
++
+ struct fsck_gitmodules_data {
+ 	struct object *obj;
+ 	struct fsck_options *options;
+@@ -969,8 +983,8 @@
+ 				    "disallowed submodule name: %s",
+ 				    name);
+ 	if (!strcmp(key, "url") && value &&
+-	    looks_like_command_line_option(value))
+-		data->ret |= report(data->options, data->obj,
++		check_submodule_url(value) < 0)
++        data->ret |= report(data->options, data->obj,
+ 				    FSCK_MSG_GITMODULES_URL,
+ 				    "disallowed submodule url: %s",
+ 				    value);
+diff -ur b/t/lib-credential.sh a/t/lib-credential.sh
+--- b/t/lib-credential.sh	2020-04-09 09:53:10.501938148 +0200
++++ a/t/lib-credential.sh	2020-04-09 12:28:10.369496961 +0200
+@@ -19,7 +19,7 @@
+ 		false
+ 	fi &&
+ 	test_cmp expect-stdout stdout &&
+-	test_cmp expect-stderr stderr
++	test_i18ncmp expect-stderr stderr
+ }
+ 
+ read_chunk() {
+diff -ur b/t/t0300-credentials.sh a/t/t0300-credentials.sh
+--- b/t/t0300-credentials.sh	2020-04-09 09:53:10.506938208 +0200
++++ a/t/t0300-credentials.sh	2020-04-09 12:26:42.660434645 +0200
+@@ -309,4 +309,18 @@
+ 	EOF
+ '
+ 
++test_expect_success 'url parser ignores embedded newlines' '
++	check fill <<-EOF
++	url=https://one.example.com?%0ahost=two.example.com/
++	--
++	username=askpass-username
++	password=askpass-password
++	--
++	warning: url contains a newline in its host component: https://one.example.com?%0ahost=two.example.com/
++	warning: skipping credential lookup for url: https://one.example.com?%0ahost=two.example.com/
++	askpass: Username:
++	askpass: Password:
++	EOF
++'
++
+ test_done
+diff -ur b/t/t7416-submodule-dash-url.sh a/t/t7416-submodule-dash-url.sh
+--- b/t/t7416-submodule-dash-url.sh	2020-04-09 09:53:10.528938468 +0200
++++ a/t/t7416-submodule-dash-url.sh	2020-04-09 12:27:15.594833539 +0200
+@@ -1,6 +1,6 @@
+ #!/bin/sh
+ 
+-test_description='check handling of .gitmodule url with dash'
++test_description='check handling of disallowed .gitmodule urls'
+ . ./test-lib.sh
+ 
+ test_expect_success 'create submodule with protected dash in url' '
+@@ -60,4 +60,19 @@
+ 	test_i18ngrep ! "unknown option" err
+ '
+ 
++test_expect_success 'fsck rejects embedded newline in url' '
++	git checkout --orphan newline &&
++	cat >.gitmodules <<-\EOF &&
++	[submodule "foo"]
++	url = "https://one.example.com?%0ahost=two.example.com/foo.git"
++	EOF
++	git add .gitmodules &&
++	git commit -m "gitmodules with newline" &&
++	test_when_finished "rm -rf dst" &&
++	git init --bare dst &&
++	git -C dst config transfer.fsckObjects true &&
++	test_must_fail git push dst HEAD 2>err &&
++	grep gitmodulesUrl err
++'
++
+ test_done
diff --git a/SPECS/git.spec b/SPECS/git.spec
index 7682b74..032cc89 100644
--- a/SPECS/git.spec
+++ b/SPECS/git.spec
@@ -103,7 +103,7 @@
 
 Name:           %{?scl_prefix}git
 Version:        2.18.2
-Release:        1%{?rcrev}%{?dist}
+Release:        2%{?rcrev}%{?dist}
 Summary:        Fast Version Control System
 License:        GPLv2
 URL:            https://git-scm.com/
@@ -150,6 +150,9 @@ Patch5:         0001-config-document-value-2-for-protocol.version.patch
 Patch7:         0001-run-command-mark-path-lookup-errors-with-ENOENT.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1619113
 Patch8:         git-2.18.1-core-crypto-hmac.patch
+# CVE-2020-5260
+# https://bugzilla.redhat.com/show_bug.cgi?id=1822020
+Patch9:         git-cve-2020-5260.patch
 
 %if %{with docs}
 BuildRequires:  asciidoc >= 8.4.1
@@ -961,6 +964,10 @@ make test || ./print-failed-test-output
 %{?with_docs:%{_pkgdocdir}/git-instaweb.html}
 
 %changelog
+* Thu Apr 9 2020 Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-2
+- Crafted URL containing new lines can cause credential leak  
+- Resolves: CVE-2020-5260
+
 * Tue Dec 17 2019 Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-1
 - Update to release 2.18.2
 - Remote code execution in recursive clones with nested submodules