On 18th December, a vulnerability in git and mecurial was announced.
- What are the details of the vulnerability?
- Does it affect me?
- What should I do?
What are the details of the vulnerability?
Git stores repository metadata in a
.git sub-directory. This includes git hooks that allow custom scripts to be run at various points in the git workflow. Git normally does not allow any files in this sub-directory to be committed.
However, sub-directories like
.Git on can be committed into the repository. This vulnerability arises because operating systems with case-insensitive filesystems (such as Windows or OS X), will treat the two sub-directories (
.git) as equivalent and will overwrite
.git with the contents of
.Git. This results in an attacker being able to execute arbitrary code by tricking users using operating systems with case-insensitive filesystems into cloning a maliciously crafted repository.
Does it affect me?
The vulnerability only works on users using case-insensitive filesystems. This include most Windows and OS X users.
Pulling repositories from GitHub is safe because GitHub now blocks repositories from containing the malicious exploit.
What should I do?
As with all new vulnerabilities, upgrade the affected software. This means upgrading to versions v18.104.22.168, v1.9.5, v2.0.5, v2.1.4, and v2.2.1 of git depending on which maintenance branch you are using.