CVE-2018-11235

Description

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	git	1:2.17.1-1	—
Debian 13	git	1:2.17.1-1	—
Debian 12	git	1:2.17.1-1	—
Debian 9	git	1:2.11.0-3+deb9u3	DSA-4212-1
Debian 8	git	1:2.1.4-2.1+deb8u6	DSA-4212-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	git	1:2.17.1-1ubuntu0.1	USN-3671-1
Ubuntu 16.04 LTS	git	1:2.7.4-0ubuntu1.4	USN-3671-1
Ubuntu 14.04 LTS	git	1:1.9.1-1ubuntu0.8	USN-3671-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	git +15	1.8.3.1-14.el7_5	RHSA-2018:1957
RHEL 3	rh-git29-git +15	2.9.3-4.el6	RHSA-2018:2147

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP1	git	2.26.1-3.25.2	SUSE-SU-2020:1121-1
SLES 15	git	2.16.4-3.3.2	SUSE-SU-2018:1872-1
SLES 15	libgit2	0.26.6-3.5.2	SUSE-SU-2018:2469-1
SLES 12 SP3	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SLES 12 SP3	libgit2	0.24.1-7.6.1	SUSE-SU-2018:3440-1
SLES 12 SP2	git	2.12.3-27.14.1	SUSE-SU-2018:1566-2, SUSE-SU-2018:1566-1
SLES 12 SP1	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1

Show 10 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SLES for SAP 12 SP3	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SLES for SAP 12 SP2	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SLES for SAP 12 SP1	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SUSE OpenStack Cloud 8	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SUSE OpenStack Cloud 7	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SUSE Manager Server 3.2	libgit2	0.24.1-7.6.1	SUSE-SU-2018:3440-1
SUSE Manager Server 3.1	libgit2	0.24.1-7.6.1	SUSE-SU-2018:3440-1
SUSE HPE Helion OpenStack 8	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1
SUSE Enterprise Storage 4	git	2.12.3-27.14.1	SUSE-SU-2018:1566-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	git	2.33.0-1.3	openSUSE-SU-2024:10786-1
openSUSE Tumbleweed	libgit2	1.1.1-1.2	openSUSE-SU-2024:10943-1
openSUSE Leap 15.1	git	2.26.1-lp151.4.9.1	openSUSE-SU-2020:0598-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	git	2.17.1-r0	—
Alpine v3.23	git	2.17.1-r0	—
Alpine v3.22	git	2.17.1-r0	—
Alpine v3.21	git	2.17.1-r0	—
Alpine v3.20	git	2.17.1-r0	—

Show 15 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	git	2.17.1-r0	—
Alpine v3.18	git	2.17.1-r0	—
Alpine v3.17	git	2.17.1-r0	—
Alpine v3.16	git	2.17.1-r0	—
Alpine v3.15	git	2.17.1-r0	—
Alpine v3.14	git	2.17.1-r0	—
Alpine v3.13	git	2.17.1-r0	—
Alpine v3.12	git	2.17.1-r0	—
Alpine v3.11	git	2.17.1-r0	—
Alpine v3.10	git	2.17.1-r0	—
Alpine v3.9	git	2.17.1-r0	—
Alpine v3.8	git	2.17.1-r0	—
Alpine v3.7	git	2.15.2-r0	—
Alpine v3.6	git	2.13.7	—
Alpine v3.5	git	2.11.3-r1	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	git +14	2.14.4-1.amzn2	ALAS2-2018-1035

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	git +15	1.8.3.1-14.el7_5	ELSA-2018-1957

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 14 repositories · most starred shown

Rogdham/CVE-2018-11235 ★ 48 · May 30, 2018

PoC exploit for CVE-2018-11235 allowing RCE on git clone --recurse-submodules
CHYbeta/CVE-2018-11235-DEMO ★ 14 · Jun 1, 2018
qweraqq/CVE-2018-11235-Git-Submodule-CE ★ 3 · Apr 9, 2019

CVE-2018-11235-Git PoC
j4k0m/CVE-2018-11235 ★ 2 · Sep 22, 2021

Auto malicious git repository creation to exploit CVE-2018-11235 a Remote Code Execution using Git Sub module.
AnonymKing/CVE-2018-11235 ★ 1 · Jun 22, 2019

CVE-2018-11235（PoC && Exp）
ygouzerh/CVE-2018-11235 ★ 1 · Dec 3, 2018

Proof of Concept - RCE Exploitation : Git submodules' names vulnerability - Ensimag November 2018
knqyf263/CVE-2018-11235 ★ 0 · Aug 1, 2018

CVE-2018-11235 (Git)
H0K5/clone_and_pwn ★ 0 · Jun 11, 2018

Exploits CVE-2018-11235
Kiss-sh0t/CVE-2018-11235-poc ★ 0 · Jun 6, 2018

for git v2.7.4
vmotos/CVE-2018-11235 ★ 0 · May 31, 2018

RCE vulnerability to exec "git clone --recurse-submodule" (CVE-2018-11235)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 16

RHSA-2018:2147 Red Hat Security Advisory: rh-git29-git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:1957 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DSA-4212-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
USN-3671-1 git vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
openSUSE-SU-2020:0598-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:3440-1 Security update for libgit2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1566-2 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:10786-1 git-2.33.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:10943-1 libgit2-1_1-1.1.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1872-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:2469-1 Security update for libgit2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1121-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1566-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
VDE-2023-016 Phoenix Contact: PLCnext Engineer Vulnerabilities in LibGit2Sharp/LibGit2 CERT@VDE · May 22, 2025
ELSA-2018-1957 Important: git security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 20, 2018
ALAS2-2018-1035 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 11, 2018

References

44822 exploit
RHSA-2018:2147 vendor-advisory
USN-3671-1 vendor-advisory
https://marc.info/?l=git&m=152761328506724&w=2
1040991 vdb-entry
RHSA-2018:1957 vendor-advisory
GLSA-201805-13 vendor-advisory
104345 vdb-entry
https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/
DSA-4212 vendor-advisory
openSUSE-SU-2020:0598 vendor-advisory

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can…

Description

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

SUSE

openSUSE

Alpine

Amazon Linux

Oracle Linux

Public exploits

GitHub 14 repositories · most starred shown

Advisories 16

References