Impact
When cloning onto a Windows drive or onto a mounted file share with NTFS short names enabled, Git could be tricked into writing a submodule's .git file such that it would have an unexpected short name (e.g. git~2). This would allow maliciously-crafted submodules to circumvent the protections of core.protectNTFS and overwrite the contents of the .git file and thereby causing remote code to be executed during the recursive clone.
This affects Git for Windows, and potentially any platform where Git is used to clone onto a mounted network drive.
Patches
The problem has been patched in the versions published on Tuesday, December 10th, 2019.
On Windows, it is recommended to upgrade to Git for Windows v2.24.1(2).
Workarounds
Avoid running git clone --recurse-submodules with untrusted repositories.
References
Impact
When cloning onto a Windows drive or onto a mounted file share with NTFS short names enabled, Git could be tricked into writing a submodule's
.gitfile such that it would have an unexpected short name (e.g.git~2). This would allow maliciously-crafted submodules to circumvent the protections ofcore.protectNTFSand overwrite the contents of the.gitfile and thereby causing remote code to be executed during the recursive clone.This affects Git for Windows, and potentially any platform where Git is used to clone onto a mounted network drive.
Patches
The problem has been patched in the versions published on Tuesday, December 10th, 2019.
On Windows, it is recommended to upgrade to Git for Windows v2.24.1(2).
Workarounds
Avoid running
git clone --recurse-submoduleswith untrusted repositories.References