CVE-2018-11235 Path traversal in n/a
Attackers can execute arbitrary code via crafted .gitmodules files during recursive cloning, affecting developers using Git.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-11235?
CVE-2018-11235 is a high-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 30 May 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Weakness: CWE-22
Which versions are affected by CVE-2018-11235?
It affects 9 products.
Linux distribution packages (40)
emacs-git Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
emacs-git-el Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-all Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-bzr Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-cvs Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-daemon Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-email Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-gui Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-hg Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-p4 Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
git-svn Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
gitk Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
gitweb Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
perl-Git Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
perl-Git-SVN Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3.1-14.el7_5 |
emacs-git Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
emacs-git-el Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-all Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-bzr Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-cvs Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-daemon Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-email Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-gui Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-hg Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-p4 Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
git-svn Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
gitk Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
gitweb Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
perl-Git Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
perl-Git-SVN Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3.1-14.el7_5 |
emacs-git Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3.1-14.el7_5 |
emacs-git-el Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3.1-14.el7_5 |
git Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3.1-14.el7_5 |
git-all Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3.1-14.el7_5 |
git-bzr Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3.1-14.el7_5 |
git-cvs Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3.1-14.el7_5 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Git-Scm Git, Gitforwindows Git, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop and 3 more.
How do I fix CVE-2018-11235?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-11235 being exploited?
There is no known exploitation of CVE-2018-11235 in the wild and no public exploit code.
Public exploit code: 15 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-11235, CLEANSTART-2025-DA54613, DEBIAN-CVE-2018-11235, DSA-4212-1, GHSA-v6w3-vcjx-mwhx, RHSA-2018:1957 and 1 more.