On 18th December, a vulnerability in git and mecurial was announced. 

  • What are the details of the vulnerability? 
  • Does it affect me? 
  • What should I do?

What are the details of the vulnerability?

Git stores repository metadata in a .git sub-directory. This includes git hooks that allow custom scripts to be run at various points in the git workflow. Git normally does not allow any files in this sub-directory to be committed.

However, sub-directories like .Git on can be committed into the repository. This vulnerability arises because operating systems with case-insensitive filesystems (such as Windows or OS X), will treat the two sub-directories (.Git and .git) as equivalent and will overwrite .git with the contents of .Git. This results in an attacker being able to execute arbitrary code by tricking users using operating systems with case-insensitive filesystems into cloning a maliciously crafted repository.

Does it affect me?

The vulnerability only works on users using case-insensitive filesystems. This include most Windows and OS X users.

Pulling repositories from GitHub is safe because GitHub now blocks repositories from containing the malicious exploit.

What should I do?

As with all new vulnerabilities, upgrade the affected software. This means upgrading to versions v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1 of git depending on which maintenance branch you are using.

  • 9
    Another detail: It's not only computers with case-insensitive filesystems that are vulnerable. Windows and OS X can both be set to treat files in a case-sensitive way, but even then filenames like git~1 (on Windows) and .g\u200cit (on OS X) will be treated the same as .git, leaving both of those operating systems vulnerable to this exploit. (Source) – Ajedi32 Dec 22 '14 at 14:33
  • Also, servers can benefit from the fix, too; see developer.atlassian.com/blog/2014/12/securing-your-git-server – SamB Dec 28 '14 at 7:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.