vulnerability
Oracle Linux: CVE-2018-11235: ELSA-2018-1957: git security update (IMPORTANT) (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | 2018-05-30 | 2018-06-21 | 2025-01-07 |
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
2018-05-30
Added
2018-06-21
Modified
2025-01-07
Description
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Solution(s)
oracle-linux-upgrade-emacs-gitoracle-linux-upgrade-emacs-git-eloracle-linux-upgrade-gitoracle-linux-upgrade-git-alloracle-linux-upgrade-git-bzroracle-linux-upgrade-git-cvsoracle-linux-upgrade-git-daemonoracle-linux-upgrade-git-emailoracle-linux-upgrade-git-guioracle-linux-upgrade-git-hgoracle-linux-upgrade-gitkoracle-linux-upgrade-git-p4oracle-linux-upgrade-git-svnoracle-linux-upgrade-gitweboracle-linux-upgrade-perl-gitoracle-linux-upgrade-perl-git-svn
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.