On 18th December, a vulnerability in git and mecurial was announced.
- What are the details of the vulnerability?
- Does it affect me?
- What should I do?
What are the details of the vulnerability?
Git stores repository metadata in a .git
sub-directory. This includes git hooks that allow custom scripts to be run at various points in the git workflow. Git normally does not allow any files in this sub-directory to be committed.
However, sub-directories like .Git
on can be committed into the repository. This vulnerability arises because operating systems with case-insensitive filesystems (such as Windows or OS X), will treat the two sub-directories (.Git
and .git
) as equivalent and will overwrite .git
with the contents of .Git
. This results in an attacker being able to execute arbitrary code by tricking users using operating systems with case-insensitive filesystems into cloning a maliciously crafted repository.
Does it affect me?
The vulnerability only works on users using case-insensitive filesystems. This include most Windows and OS X users.
Pulling repositories from GitHub is safe because GitHub now blocks repositories from containing the malicious exploit.
What should I do?
As with all new vulnerabilities, upgrade the affected software. This means upgrading to versions v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1 of git depending on which maintenance branch you are using.
git~1
(on Windows) and .g\u200cit
(on OS X) will be treated the same as .git
, leaving both of those operating systems vulnerable to this exploit. (Source)