GitHub fixes a remote code security vulnerability that affects Linux system

GitHub is the preferred code sharing and hosting service for developers worldwide. Although the EU has not finalized the deal, the company was acquired by Microsoft in June for a price of $7.5 billion. Today, GitHub revealed a vulnerability in their system that allows exploits for arbitrary code execution (CVE-2018-17456). This problem has been solved now, and only the Unix platform is currently affected.

When running “git clone –recurse-submodules”, Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a “git clone” subprocess. If the URL field is set to a string that begins with a dash, this “git clone” subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran “git clone”.

In addition to fixing the security issue for the user running “clone”, the 2.17.2, 2.18.1 and 2.19.1 releases have an “fsck” check which can be used to detect such malicious repository content when fetching or accepting a push. See “transfer.fsckObjects” in git-config(1).

GitHub still recommends users to upgrade to Git versions 2.17.2, 2.18.1 and 2.19.1.