Skip to content
OpenAdvisories
High ALAS2-2018-1093 1 CVE

Important: git security update (Amazon Linux 2)

Published Oct 24, 2018 · Updated Oct 25, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-17456: Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character. 1636619: CVE-2018-17456 git: arbitrary code execution via .gitmodules

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 git 0:2.14.5-1.amzn2
Amazon Linux · 2 git-all 0:2.14.5-1.amzn2
Amazon Linux · 2 git-core 0:2.14.5-1.amzn2
Amazon Linux · 2 git-core-doc 0:2.14.5-1.amzn2
Amazon Linux · 2 git-cvs 0:2.14.5-1.amzn2
Amazon Linux · 2 git-daemon 0:2.14.5-1.amzn2
Amazon Linux · 2 git-debuginfo 0:2.14.5-1.amzn2
Amazon Linux · 2 git-email 0:2.14.5-1.amzn2
Amazon Linux · 2 git-gnome-keyring 0:2.14.5-1.amzn2
Amazon Linux · 2 git-gui 0:2.14.5-1.amzn2
Amazon Linux · 2 git-p4 0:2.14.5-1.amzn2
Amazon Linux · 2 git-svn 0:2.14.5-1.amzn2
Amazon Linux · 2 gitk 0:2.14.5-1.amzn2
Amazon Linux · 2 gitweb 0:2.14.5-1.amzn2
Amazon Linux · 2 perl-Git 0:2.14.5-1.amzn2
Amazon Linux · 2 perl-Git-SVN 0:2.14.5-1.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2018-17456 Public exploit EPSS 97%

    Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x b…

    git git git Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-17456.html