On 18th December, a vulnerability in git and mecurial was announced.
- What are the details of the vulnerability?
- Does it affect me?
- What should I do?
1 Answer
What are the details of the vulnerability?
Git stores repository metadata in a .git sub-directory. This includes git hooks that allow custom scripts to be run at various points in the git workflow. Git normally does not allow any files in this sub-directory to be committed.
However, sub-directories like .Git on can be committed into the repository. This vulnerability arises because operating systems with case-insensitive filesystems (such as Windows or OS X), will treat the two sub-directories (.Git and .git) as equivalent and will overwrite .git with the contents of .Git. This results in an attacker being able to execute arbitrary code by tricking users using operating systems with case-insensitive filesystems into cloning a maliciously crafted repository.
Does it affect me?
The vulnerability only works on users using case-insensitive filesystems. This include most Windows and OS X users.
Pulling repositories from GitHub is safe because GitHub now blocks repositories from containing the malicious exploit.
What should I do?
As with all new vulnerabilities, upgrade the affected software. This means upgrading to versions v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1 of git depending on which maintenance branch you are using.
-
10Another detail: It's not only computers with case-insensitive filesystems that are vulnerable. Windows and OS X can both be set to treat files in a case-sensitive way, but even then filenames like
git~1(on Windows) and.g\u200cit(on OS X) will be treated the same as.git, leaving both of those operating systems vulnerable to this exploit. (Source)– Ajedi32Dec 22, 2014 at 14:33 -
Also, servers can benefit from the fix, too; see developer.atlassian.com/blog/2014/12/securing-your-git-server– SamBDec 28, 2014 at 7:54