Improper input validation in Git - CVE-2018-11235

Vulnerability identifier: #VU13047

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11235

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper validation of submodule "names" supplied via the untrusted .gitmodules file when appending them to the '$GIT_DIR/modules' directory. A remote attacker can return specially crafted data to create or overwrite files on the target user's system when the repository is cloned and execute arbitrary code with elevated privileges.

Git
Amazon Linux AMI
Debian Linux
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Fedora
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Opensuse
git (Alpine package)
openSUSE Leap
libgit2
git
Apple Xcode

Update to version 2.17.1.

git (Alpine package) - update to 2.11.3-r1
libgit2 - addressed in versions 0.26.4-1.el7, 0.26.4-1.fc27, 0.26.4-1.fc28
git - addressed in versions 2.14.4-1.fc27, 2.17.1-2.fc28

• Exploit #6108 - Git Submodule - Arbitrary Code Execution (June 17, 2021)
• Exploit #4764 - CVE-2018-11235-PoC (PoC exploit for CVE-2018-11235 allowing RCE on git clone --recurse-submodules ) (October 28, 2020)
• Exploit #1951 - CVE-2018-11235 (PoC exploit for CVE-2018-11235 allowing RCE on git clone --recurse-submodules) (March 18, 2020)
• Exploit #1952 - clone_and_pwn (Exploits CVE-2018-11235) (March 18, 2020)
• Exploit #2019 - CVE-2018-11235 (Proof of Concept - RCE Exploitation : Git submodules' names vulnerability - Ensimag November 2018) (March 18, 2020)

• https://github.com/git/git/blob/master/Documentation/RelNotes/2.17.1.txt

• Multiple vulnerabilities in Git
• Debian update for git
• Gentoo update for Git
• Arch Linux update for git
• Slackware Linux update for git
• OpenSUSE Linux update for git
• Amazon Linux AMI update for git
• Multiple vulnerabilities in Apple Xcode
• Red Hat update for Git
• Red Hat update for git
• OpenSUSE Linux update for libgit2
• OpenSUSE Linux update for libgit2
• OpenSUSE Linux update for procps
• OpenSUSE Linux update for procps
• OpenSUSE Linux update for git
• Improper input validation in git (Alpine package)
• Fedora 27 update for git
• Fedora 28 update for git
• Fedora 28 update for libgit2
• Fedora EPEL 7 update for libgit2
• Fedora 27 update for libgit2