Git security vulnerabilities announced

The Git project has fixed six security vulnerabilities, and the most serious one lets a malicious repository run code on your machine when you clone it recursively, meaning together with its submodules (other repositories it embeds). GitHub's announcement says the fixes are in Git 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Git normally checks each path before writing a file and refuses paths that would overwrite its own metadata. An integer truncation in its index handling let an extremely long path pass that check under one name and then be written under a shorter one. An attacker can use that to replace a submodule's .git file with a link to a directory holding malicious configuration or hooks, scripts Git runs automatically, and Git then executes them during the clone. The fix rejects such long paths before their length can be truncated.

The other five mostly matter where Git processes input someone else controls, including hosting services that merge on behalf of users. A malicious server can make Git store a branch name containing path-traversal components when you clone an empty repository, letting a later branch update write outside the reference directory. Merging a tag with more than two signatures overruns a fixed-size stack array. A small compressed binary patch can expand past Git's limit of roughly 1 GiB and cause an out-of-bounds read that crashes Git. A very large merge, including one with many conflicts and a large conflict-marker size, can overflow a size calculation and corrupt heap memory. Three features of git fast-import, a tool that builds a repository from a stream of commands, could read arbitrary files or create and append to files; they are now refused in an untrusted stream unless the caller passes --allow-unsafe-features.

GitHub has already patched github.com and GitHub Enterprise Cloud, and ships fixes for GitHub Enterprise Server in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4. It is coordinating patched releases of GitHub Desktop and the GitHub Copilot app, and says Codespaces and Actions will also get patched Git. Everyone else needs to update their own Git, and any application that bundles its own copy, including Git used by automation and services that handle other people's repositories. Until then, GitHub advises cloning only from trusted servers, avoiding recursive clones of untrusted repositories, and not merging untrusted content or tags or processing untrusted binary patches or fast-import streams, while stressing that these precautions do not replace the update.