Fast Version Control System
0588f15273
From the release announcement¹
A malicious third-party can give a crafted "ssh://..." URL to an
unsuspecting victim, and an attempt to visit the URL can result in
any program that exists on the victim's machine being executed.
Such a URL could be placed in the .gitmodules file of a malicious
project, and an unsuspecting victim could be tricked into running
"git clone --recurse-submodules" to trigger the vulnerability.
Credits to find and fix the issue go to Brian Neel at GitLab, Joern
Schneeweisz of Recurity Labs and Jeff King at GitHub.
¹ https://public-inbox.org/git/xmqqh8xf482j.fsf@gitster.mtv.corp.google.com/
|
||
|---|---|---|
| .gitignore | ||
| git-1.8-gitweb-home-link.patch | ||
| git-cvsimport-Ignore-cvsps-2.2b1-Branches-output.patch | ||
| git-gui.desktop | ||
| git-init.el | ||
| git.conf.httpd | ||
| git.socket | ||
| git.spec | ||
| git.xinetd.in | ||
| git@.service | ||
| gitweb.conf.in | ||
| gpgkey-junio.asc | ||
| sources | ||