In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-git | Jun 13, 2018 | May 30, 2018 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-gitamazon-linux-ami-2-upgrade-git-allamazon-linux-ami-2-upgrade-git-coreamazon-linux-ami-2-upgrade-git-core-docamazon-linux-ami-2-upgrade-git-cvsamazon-linux-ami-2-upgrade-git-daemonamazon-linux-ami-2-upgrade-git-debuginfoamazon-linux-ami-2-upgrade-git-emailamazon-linux-ami-2-upgrade-git-gnome-keyringamazon-linux-ami-2-upgrade-git-guiamazon-linux-ami-2-upgrade-git-p4amazon-linux-ami-2-upgrade-git-svnamazon-linux-ami-2-upgrade-gitkamazon-linux-ami-2-upgrade-gitwebamazon-linux-ami-2-upgrade-perl-gitamazon-linux-ami-2-upgrade-perl-git-svn | Apr 27, 2020 | May 30, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-git | Jun 12, 2018 | May 29, 2018 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | May 30, 2018 | |
| Centos_linux | — | centos-upgrade-emacs-gitcentos-upgrade-emacs-git-elcentos-upgrade-gitcentos-upgrade-git-allcentos-upgrade-git-bzrcentos-upgrade-git-cvscentos-upgrade-git-daemoncentos-upgrade-git-debuginfocentos-upgrade-git-emailcentos-upgrade-git-guicentos-upgrade-git-hgcentos-upgrade-git-p4centos-upgrade-git-svncentos-upgrade-gitkcentos-upgrade-gitwebcentos-upgrade-perl-gitcentos-upgrade-perl-git-svn | Jun 26, 2018 | May 29, 2018 |
| Debian | debian-upgrade-git | May 31, 2018 | May 29, 2018 | |
| Freebsd | freebsd-upgrade-package-libgit2freebsd-upgrade-package-py-pygit2freebsd-upgrade-package-gitfreebsd-upgrade-package-git-lite | Jun 5, 2018 | Jun 5, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-vcs-git | May 30, 2018 | May 30, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-githuawei-euleros-2_0_sp2-upgrade-perl-git | Jul 3, 2018 | May 30, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-githuawei-euleros-2_0_sp3-upgrade-perl-git | Jul 3, 2018 | May 30, 2018 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-developer-versioning-git-2-15-2-0-175-3-34-0-2-0 | Jul 18, 2018 | May 30, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-emacs-gitoracle-linux-upgrade-emacs-git-eloracle-linux-upgrade-gitoracle-linux-upgrade-git-alloracle-linux-upgrade-git-bzroracle-linux-upgrade-git-cvsoracle-linux-upgrade-git-daemonoracle-linux-upgrade-git-emailoracle-linux-upgrade-git-guioracle-linux-upgrade-git-hgoracle-linux-upgrade-gitkoracle-linux-upgrade-git-p4oracle-linux-upgrade-git-svnoracle-linux-upgrade-gitweboracle-linux-upgrade-perl-gitoracle-linux-upgrade-perl-git-svn | Jun 21, 2018 | May 30, 2018 |
| Redhat_linux | — | redhat-upgrade-emacs-gitredhat-upgrade-emacs-git-elredhat-upgrade-gitredhat-upgrade-git-allredhat-upgrade-git-bzrredhat-upgrade-git-cvsredhat-upgrade-git-daemonredhat-upgrade-git-debuginforedhat-upgrade-git-emailredhat-upgrade-git-guiredhat-upgrade-git-hgredhat-upgrade-git-p4redhat-upgrade-git-svnredhat-upgrade-gitkredhat-upgrade-gitwebredhat-upgrade-perl-gitredhat-upgrade-perl-git-svn | Jun 21, 2018 | May 29, 2018 |
| Suse | — | suse-upgrade-gitsuse-upgrade-git-archsuse-upgrade-git-coresuse-upgrade-git-credential-gnome-keyringsuse-upgrade-git-credential-libsecretsuse-upgrade-git-cvssuse-upgrade-git-daemonsuse-upgrade-git-docsuse-upgrade-git-emailsuse-upgrade-git-guisuse-upgrade-git-p4suse-upgrade-git-svnsuse-upgrade-git-websuse-upgrade-gitksuse-upgrade-libgit2-24suse-upgrade-libgit2-26suse-upgrade-libgit2-26-32bitsuse-upgrade-libgit2-28suse-upgrade-libgit2-devel | Jun 6, 2018 | May 29, 2018 |
| Ubuntu | ubuntu-upgrade-git | Jun 12, 2018 | May 29, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | May 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub