In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Jun 13, 2018 | May 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade perl-GitUpgrade git-allUpgrade git-gnome-keyringUpgrade git-cvsUpgrade git-svnUpgrade git-daemonUpgrade gitwebUpgrade git-core-docUpgrade git-guiUpgrade git-p4Upgrade perl-Git-SVNUpgrade gitkUpgrade gitUpgrade git-coreUpgrade git-debuginfoUpgrade git-email | Apr 27, 2020 | May 30, 2018 |
| Amazon_linux | — | Upgrade git | Jun 12, 2018 | May 29, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 30, 2018 |
| Centos_linux | — | Upgrade git-allUpgrade git-bzrUpgrade git-svnUpgrade perl-GitUpgrade git-debuginfoUpgrade gitwebUpgrade git-cvsUpgrade git-guiUpgrade git-daemonUpgrade git-hgUpgrade git-emailUpgrade perl-Git-SVNUpgrade emacs-git-elUpgrade emacs-gitUpgrade gitUpgrade gitkUpgrade git-p4 | Jun 26, 2018 | May 29, 2018 |
| Debian | — | Upgrade git | May 31, 2018 | May 29, 2018 |
| Freebsd | — | Upgrade gitUpgrade py-pygit2Upgrade git-liteUpgrade libgit2 | Jun 5, 2018 | Jun 5, 2018 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | May 30, 2018 | May 30, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Jul 3, 2018 | May 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Jul 3, 2018 | May 30, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.2-0.175.3.34.0.2.0 on Solaris 11.3 | Jul 18, 2018 | May 30, 2018 |
| Oracle_linux | — | Upgrade gitUpgrade git-svnUpgrade git-cvsUpgrade git-emailUpgrade git-allUpgrade git-bzrUpgrade emacs-gitUpgrade gitwebUpgrade git-hgUpgrade perl-GitUpgrade gitkUpgrade perl-Git-SVNUpgrade git-daemonUpgrade git-p4Upgrade git-guiUpgrade emacs-git-el | Jun 21, 2018 | May 30, 2018 |
| Redhat_linux | — | Upgrade git-emailUpgrade git-p4Upgrade git-debuginfoUpgrade git-allUpgrade gitwebUpgrade git-daemonUpgrade git-guiUpgrade emacs-git-elUpgrade perl-GitUpgrade emacs-gitUpgrade perl-Git-SVNUpgrade gitUpgrade git-hgUpgrade git-svnUpgrade git-bzrUpgrade git-cvsUpgrade gitk | Jun 21, 2018 | May 29, 2018 |
| Suse | — | Upgrade git-cvsUpgrade git-coreUpgrade gitkUpgrade git-credential-libsecretUpgrade gitUpgrade libgit2-24Upgrade git-archUpgrade git-svnUpgrade git-daemonUpgrade libgit2-26Upgrade git-docUpgrade git-emailUpgrade git-p4Upgrade libgit2-develUpgrade libgit2-26-32bitUpgrade git-webUpgrade libgit2-28Upgrade git-guiUpgrade git-credential-gnome-keyring | Jun 6, 2018 | May 29, 2018 |
| Ubuntu | — | Upgrade git | Jun 12, 2018 | May 29, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 30, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub