==========================================================================
Ubuntu Security Notice USN-3791-1
October 12, 2018
git vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
Summary:
Git could be made to run programs as your login if it recursively
opened a malicious git repository.
Software Description:
– git: fast, scalable, distributed revision control system
Details:
It was discovered that git did not properly validate git submodule
urls or paths. A remote attacker could possibly use this to craft a
git repository that causes arbitrary code execution when recursive
operations are used.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
git 1:2.17.1-1ubuntu0.3
Ubuntu 16.04 LTS:
git 1:2.7.4-0ubuntu1.5
Ubuntu 14.04 LTS:
git 1:1.9.1-1ubuntu0.9
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3791-1
CVE-2018-17456
Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.17.1-1ubuntu0.3
https://launchpad.net/ubuntu/+source/git/1:2.7.4-0ubuntu1.5
https://launchpad.net/ubuntu/+source/git/1:1.9.1-1ubuntu0.9
—–BEGIN PGP SIGNATURE—–
iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAlu/9fQACgkQLwmejQBe
gfR8XQ/+PW3SKspVa+3CCIslyO760587cJaYDxn8XaDlMER2jxBnI3DSXV+JlapP
TqYUTF2oUw4od5qqDEvzzrxXpd8S9u8IWxKUQgJAzQgnMlGhT6d+saFSZkKOcScd
MMM63GiEG3M6hioe61pHEw/ltX3NJgrncvKC1wP6jM2hvvV0YbFqcuoMUEhUJVcv
lH/XGFnjZhIAwf9ticZC92nvgVtPmS3UOEtLEa6Z7AE8e1szkO26FpLYjAHMYO90
4lkqj8EHLb8GlU3nZSSwqfGOTPvsnW/lMECs0WWC3JZ0PaWPZNXiCnNJ2JmXCeJs
TFKL5lpDN6CXNAsf+MHsbFTVefgbbjhbdESt90MwmJnbRuVSLNQsDltRY+7vnw5c
tuirsRk+HYXNbiivhcbKlcpERDB7E9YmL+AijQO/3gie+92jFDs0m482ufJk9oWP
nsPdiL+PStuqzKo8W8AdIqyqbxUVDSdadrVXuxN3TzMEp/0LTekZO4077gvU9wZr
qgDG/NqOhCZ6lmGLHXmYUIPKM9bTFuAReW4dZz22d7dHM39gr6ymUtYU+IA7nfim
SYEd5tQ8Lk+8J/kuex+kyhbXO9qfxJg2GsWtaHt6qCXWsWvP3lkYV4EfFpiJNBeL
QO8tPD0vB9RW5/edHx2f3r66gZRX1RoL3q8I10qTAVfRMg2I6Rc=
=q5LD
—–END PGP SIGNATURE—–
—
