Upstream security update resolving an issue with git clone --recurse-submodules.
From the upstream release announcement:
These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules.
When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone".
In addition to fixing the security issue for the user running "clone", the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can be used to detect such malicious repository content when fetching or accepting a push. See "transfer.fsckObjects" in git-config(1).
Credit for finding and fixing this vulnerability goes to joernchen and Jeff King, respectively.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2018-1c1a318a0bPlease login to add feedback.
This update has been submitted for testing by tmz.
tmz edited this update.
This update has been pushed to testing.
LGTM with github repos
No regressions found
no regressions noted
This update has been submitted for batched by bodhi.
This update has been submitted for stable by tmz.
This update has been pushed to stable.