In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Jun 13, 2018 | May 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gitkUpgrade git-emailUpgrade git-p4Upgrade gitUpgrade git-coreUpgrade git-debuginfoUpgrade perl-Git-SVNUpgrade git-svnUpgrade gitwebUpgrade git-gnome-keyringUpgrade git-cvsUpgrade git-allUpgrade git-daemonUpgrade git-guiUpgrade git-core-docUpgrade perl-Git | Apr 27, 2020 | May 30, 2018 |
| Amazon_linux | — | Upgrade git | Jun 12, 2018 | May 29, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 30, 2018 |
| Centos_linux | — | Upgrade git-debuginfoUpgrade git-bzrUpgrade git-allUpgrade git-cvsUpgrade git-daemonUpgrade git-svnUpgrade git-guiUpgrade perl-GitUpgrade gitwebUpgrade perl-Git-SVNUpgrade emacs-git-elUpgrade git-p4Upgrade emacs-gitUpgrade git-emailUpgrade git-hgUpgrade gitkUpgrade git | Jun 26, 2018 | May 29, 2018 |
| Debian | — | Upgrade git | May 31, 2018 | May 29, 2018 |
| Freebsd | — | Upgrade git-liteUpgrade py-pygit2Upgrade libgit2Upgrade git | Jun 5, 2018 | Jun 5, 2018 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | May 30, 2018 | May 30, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Jul 3, 2018 | May 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Jul 3, 2018 | May 30, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.2-0.175.3.34.0.2.0 on Solaris 11.3 | Jul 18, 2018 | May 30, 2018 |
| Oracle_linux | — | Upgrade gitwebUpgrade perl-Git-SVNUpgrade git-p4Upgrade git-daemonUpgrade gitkUpgrade emacs-git-elUpgrade git-hgUpgrade git-bzrUpgrade emacs-gitUpgrade git-guiUpgrade perl-GitUpgrade git-cvsUpgrade git-emailUpgrade git-svnUpgrade gitUpgrade git-all | Jun 21, 2018 | May 30, 2018 |
| Redhat_linux | — | Upgrade git-emailUpgrade git-debuginfoUpgrade gitwebUpgrade perl-GitUpgrade git-daemonUpgrade emacs-git-elUpgrade git-p4Upgrade git-allUpgrade git-guiUpgrade emacs-gitUpgrade gitUpgrade gitkUpgrade git-bzrUpgrade git-svnUpgrade git-cvsUpgrade git-hgUpgrade perl-Git-SVN | Jun 21, 2018 | May 29, 2018 |
| Suse | — | Upgrade git-credential-gnome-keyringUpgrade libgit2-26-32bitUpgrade libgit2-develUpgrade git-guiUpgrade libgit2-28Upgrade git-webUpgrade git-emailUpgrade gitUpgrade gitkUpgrade git-svnUpgrade git-docUpgrade git-daemonUpgrade git-cvsUpgrade libgit2-24Upgrade git-p4Upgrade git-credential-libsecretUpgrade libgit2-26Upgrade git-archUpgrade git-core | Jun 6, 2018 | May 29, 2018 |
| Ubuntu | — | Upgrade git | Jun 12, 2018 | May 29, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 30, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub