Summary
[2.18.4-2]
- Update to release 2.18.4
- Resolves: CVE-2020-11008
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | git | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-all | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-core | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-core-doc | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-daemon | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-email | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-gui | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-instaweb | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-subtree | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | git-svn | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | gitk | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | gitweb | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | perl-Git | 0:2.18.4-2.el8_2 |
| Oracle Linux · 8 | perl-Git-SVN | 0:2.18.4-2.el8_2 |
Vulnerabilities 1
-
Medium 4.0
Malicious URLs can still cause Git to send a stored credential to the wrong server
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an expl…