Fedora 27: FEDORA-2018-d5139c4fd6 Moderate: Git Arbitrary Code Execution

Git is a fast, scalable, distributed revision control system with an

unusually rich command set that provides both high-level operations

and full access to internals.

The git rpm installs common set of tools which are usually using with

small amount of dependencies. To install all git packages, including

tools for integrating with other SCMs, install the git-all meta-package.

Upstream security update resolving an issue with `git clone --recurse-submodules`. From the [upstream release announcement](https://public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct.c.googlers.com/): > These releases fix a security flaw (CVE-2018-17456), which allowed an > attacker to execute arbitrary code by crafting a malicious .gitmodules > file in a project cloned with --recurse-submodules. > > When running "git clone --recurse-submodules", Git parses the supplied > .gitmodules file for a URL field and blindly passes it as an argument > to a "git clone" subprocess. If the URL field is set to a string that > begins with a dash, this "git clone" subprocess interprets the URL as > an option. This can lead to executing an arbitrary script shipped in > the superproject as the user who ran "git clone". > > In addition to fixing the security issue for the user running "clone", > the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" c...