<story><title>A security vulnerability in Git that can lead to arbitrary code execution</title><url>https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/</url></story><parent_chain></parent_chain><comment><author>peff</author><text>A few important points that aren&amp;#x27;t mentioned in the post:&lt;p&gt;- you have to tell git to use submodules for this to trigger (so `clone --recurse-submodules` or a manual `git submodule update --init`)&lt;p&gt;- credit for discovery goes to Etienne Stalmans, who reported it to GitHub&amp;#x27;s bug bounty program&lt;p&gt;- most major hosters should prevent malicious repositories from being pushed up. This is actually where most of the work went. The fix itself was pretty trivial, but detection during push required a lot of refactoring. And involved many projects: I wrote the patches for Git itself, but others worked on libgit2, JGit, and VSTS.</text></comment>
<story><title>A security vulnerability in Git that can lead to arbitrary code execution</title><url>https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/</url></story><parent_chain></parent_chain><comment><author>gitlab-security</author><text>The monthly security release for GitLab was today, and this release was coordinated with the Git security release. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;about.gitlab.com&amp;#x2F;2018&amp;#x2F;05&amp;#x2F;29&amp;#x2F;security-release-gitlab-10-dot-8-dot-2-released&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;about.gitlab.com&amp;#x2F;2018&amp;#x2F;05&amp;#x2F;29&amp;#x2F;security-release-gitlab-...&lt;/a&gt;&lt;p&gt;In addition to our recently implemented monthly non-critical security release process (we already had a critical release process before), we are making a number of changes in how we secure GitLab.com, which includes expanding our HackerOne program this year to be a public bounty program. As always, we appreciate the contributions of security researchers.</text></comment>