LigH
1st June 2018, 09:37
Check if your repo recently updated their git package (MSYS2 did; Microsoft Windows (https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/) was affected too). — phoronix report (https://www.phoronix.com/scan.php?page=news_item&px=Git-2018-Security-CVE-2018):
The most prominent issue resolved is CVE-2018-11235 and comes down to the untrusted .gitmodules file blindly accepting submodule "names" to append to the on-disk repository paths. If inserting relative paths outside of the directory using ../, data on the system could be unknowingly compromised. Git is now protected against the possibility of malicious names being introduced to the Git modules file.
The most prominent issue resolved is CVE-2018-11235 and comes down to the untrusted .gitmodules file blindly accepting submodule "names" to append to the on-disk repository paths. If inserting relative paths outside of the directory using ../, data on the system could be unknowingly compromised. Git is now protected against the possibility of malicious names being introduced to the Git modules file.